Initial commit

sources/.eslintignore

@@ -0,0 +1,3 @@
+dist/
+lib/
+node_modules/

sources/.eslintrc.json

@@ -0,0 +1,57 @@
+{
+    "plugins": ["jest", "@typescript-eslint"],
+    "extends": ["plugin:github/recommended"],
+    "parser": "@typescript-eslint/parser",
+    "parserOptions": {
+      "ecmaVersion": 9,
+      "sourceType": "module",
+      "project": "./tsconfig.json"
+    },
+    "rules": {
+      "eslint-comments/no-use": "off",
+      "import/no-namespace": "off",
+      "i18n-text/no-en": "off",
+      "no-unused-vars": "off",
+      "no-shadow": "off",
+      "sort-imports": "off",
+      "github/array-foreach": "off",
+      "@typescript-eslint/no-unused-vars": ["error", { "argsIgnorePattern": "^_" }],
+      "@typescript-eslint/explicit-member-accessibility": ["error", {"accessibility": "no-public"}],
+      "@typescript-eslint/no-require-imports": "error",
+      "@typescript-eslint/array-type": "error",
+      "@typescript-eslint/await-thenable": "error",
+      "camelcase": "off",
+      "@typescript-eslint/explicit-function-return-type": ["error", {"allowExpressions": true}],
+      "@typescript-eslint/func-call-spacing": ["error", "never"],
+      "@typescript-eslint/no-array-constructor": "error",
+      "@typescript-eslint/no-empty-interface": "error",
+      "@typescript-eslint/no-explicit-any": "error",
+      "@typescript-eslint/no-extraneous-class": "error",
+      "@typescript-eslint/no-for-in-array": "error",
+      "@typescript-eslint/no-inferrable-types": "error",
+      "@typescript-eslint/no-misused-new": "error",
+      "@typescript-eslint/no-namespace": "error", 
+      "@typescript-eslint/no-non-null-assertion": "off",
+      "@typescript-eslint/no-shadow": "error",
+      "@typescript-eslint/no-unnecessary-qualifier": "error",
+      "@typescript-eslint/no-unnecessary-type-assertion": "error",
+      "@typescript-eslint/no-useless-constructor": "error",
+      "@typescript-eslint/no-var-requires": "error",
+      "@typescript-eslint/prefer-for-of": "warn",
+      "@typescript-eslint/prefer-function-type": "warn",
+      "@typescript-eslint/prefer-includes": "error",
+      "@typescript-eslint/prefer-string-starts-ends-with": "error",
+      "@typescript-eslint/promise-function-async": "error",
+      "@typescript-eslint/require-array-sort-compare": ["error", {"ignoreStringArrays":  true}],
+      "@typescript-eslint/restrict-plus-operands": "error",
+      "semi": "off",
+      "@typescript-eslint/semi": ["error", "never"],
+      "@typescript-eslint/type-annotation-spacing": "error",
+      "@typescript-eslint/unbound-method": "error"
+    },
+    "env": {
+      "node": true,
+      "es6": true,
+      "jest/globals": true
+    }
+  }

sources/.gitignore

@@ -0,0 +1,106 @@
+# Dependency directory
+node_modules
+
+# Rest pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+jspm_packages/
+
+# TypeScript v1 declaration files
+typings/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variables file
+.env
+.env.test
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+
+# next.js build output
+.next
+
+# nuxt.js build output
+.nuxt
+
+# vuepress build output
+.vuepress/dist
+
+# Serverless directories
+.serverless/
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/
+
+# OS metadata
+.DS_Store
+Thumbs.db
+
+# Ignore built ts files
+__tests__/runner/*
+# lib/**/*
+
+# IntelliJ IDEA config files
+.idea/
+*.iml
+
+# Local 'dist' directory within 'sources'. This is copied to ../dist by CI.
+dist/

sources/.nvmrc

@@ -0,0 +1 @@
+v16

sources/.prettierignore

@@ -0,0 +1,3 @@
+dist/
+lib/
+node_modules/

sources/.prettierrc.json

@@ -0,0 +1,11 @@
+{
+    "printWidth": 120,
+    "tabWidth": 4,
+    "useTabs": false,
+    "semi": false,
+    "singleQuote": true,
+    "trailingComma": "none",
+    "bracketSpacing": false,
+    "arrowParens": "avoid",
+    "parser": "typescript"
+  }

sources/.tool-versions

@@ -0,0 +1,3 @@
+# Configuration file for asdf version manager
+nodejs 20.10.0
+gradle 8.10

sources/jest.config.js

@@ -0,0 +1,10 @@
+module.exports = {
+  clearMocks: true,
+  moduleFileExtensions: ['js', 'ts', 'json'],
+  testEnvironment: 'node',
+  testMatch: ['**/*.test.ts'],
+  transform: {
+    '^.+\\.ts$': 'ts-jest'
+  },
+  verbose: true
+}

sources/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "gradle-actions",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Execute Gradle Build",
+  "scripts": {
+    "postinstall": "patch-package",
+    "prettier-write": "prettier --write 'src/**/*.ts'",
+    "prettier-check": "prettier --check 'src/**/*.ts'",
+    "lint": "eslint 'src/**/*.ts'",
+    "compile-dependency-submission-main": "ncc build src/actions/dependency-submission/main.ts --out dist/dependency-submission/main --source-map --no-source-map-register",
+    "compile-dependency-submission-post": "ncc build src/actions/dependency-submission/post.ts --out dist/dependency-submission/post --source-map --no-source-map-register",
+    "compile-setup-gradle-main": "ncc build src/actions/setup-gradle/main.ts --out dist/setup-gradle/main --source-map --no-source-map-register",
+    "compile-setup-gradle-post": "ncc build src/actions/setup-gradle/post.ts --out dist/setup-gradle/post --source-map --no-source-map-register",
+    "compile-wrapper-validation-main": "ncc build src/actions/wrapper-validation/main.ts --out dist/wrapper-validation/main --source-map --no-source-map-register",
+    "compile": "npm-run-all --parallel compile-*",
+    "check": "npm-run-all --parallel prettier-check lint",
+    "format": "npm-run-all --parallel prettier-write lint",
+    "test": "jest",
+    "build": "npm run format && npm run compile",
+    "all": "npm run build && npm test"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gradle/actions.git"
+  },
+  "keywords": [
+    "github",
+    "actions",
+    "github-actions",
+    "gradle"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@actions/artifact": "2.1.9",
+    "@actions/cache": "3.2.4",
+    "@actions/core": "1.10.1",
+    "@actions/exec": "1.1.1",
+    "@actions/github": "6.0.0",
+    "@actions/glob": "0.5.0",
+    "@actions/http-client": "2.2.3",
+    "@actions/tool-cache": "2.0.1",
+    "@octokit/rest": "21.0.2",
+    "@octokit/webhooks-types": "7.5.1",
+    "cheerio": "^1.0.0",
+    "semver": "7.6.3",
+    "string-argv": "0.3.2",
+    "typed-rest-client": "2.0.2",
+    "unhomoglyph": "1.0.6",
+    "which": "4.0.0"
+  },
+  "devDependencies": {
+    "@types/jest": "29.5.13",
+    "@types/node": "20.16.5",
+    "@types/unzipper": "0.10.10",
+    "@types/which": "3.0.4",
+    "@typescript-eslint/parser": "7.18.0",
+    "@vercel/ncc": "0.38.1",
+    "eslint": "8.57.0",
+    "eslint-plugin-github": "5.0.2",
+    "eslint-plugin-jest": "28.8.3",
+    "jest": "29.7.0",
+    "js-yaml": "4.1.0",
+    "nock": "13.5.5",
+    "npm-run-all": "4.1.5",
+    "patch-package": "8.0.0",
+    "prettier": "3.3.3",
+    "ts-jest": "29.2.5",
+    "typescript": "5.6.2"
+  }
+}

sources/patches/@actions+cache+3.2.4.patch

@@ -0,0 +1,113 @@
+diff --git a/node_modules/@actions/cache/lib/cache.d.ts b/node_modules/@actions/cache/lib/cache.d.ts
+index 4658366..b796e58 100644
+--- a/node_modules/@actions/cache/lib/cache.d.ts
++++ b/node_modules/@actions/cache/lib/cache.d.ts
+@@ -21,7 +21,7 @@ export declare function isFeatureAvailable(): boolean;
+  * @param enableCrossOsArchive an optional boolean enabled to restore on windows any cache created on any platform
+  * @returns string returns the key for the cache hit, otherwise returns undefined
+  */
+-export declare function restoreCache(paths: string[], primaryKey: string, restoreKeys?: string[], options?: DownloadOptions, enableCrossOsArchive?: boolean): Promise<string | undefined>;
++export declare function restoreCache(paths: string[], primaryKey: string, restoreKeys?: string[], options?: DownloadOptions, enableCrossOsArchive?: boolean): Promise<CacheEntry | undefined>;
+ /**
+  * Saves a list of files with the specified key
+  *
+@@ -31,4 +31,12 @@ export declare function restoreCache(paths: string[], primaryKey: string, restor
+  * @param options cache upload options
+  * @returns number returns cacheId if the cache was saved successfully and throws an error if save fails
+  */
+-export declare function saveCache(paths: string[], key: string, options?: UploadOptions, enableCrossOsArchive?: boolean): Promise<number>;
++export declare function saveCache(paths: string[], key: string, options?: UploadOptions, enableCrossOsArchive?: boolean): Promise<CacheEntry>;
++
++// PATCHED: Add `CacheEntry` as return type for save/restore functions
++// This allows us to track and report on cache entry sizes.
++export declare class CacheEntry {
++    key: string;
++    size?: number;
++    constructor(key: string, size?: number);
++}
+diff --git a/node_modules/@actions/cache/lib/cache.js b/node_modules/@actions/cache/lib/cache.js
+index 9d636aa..a176bd7 100644
+--- a/node_modules/@actions/cache/lib/cache.js
++++ b/node_modules/@actions/cache/lib/cache.js
+@@ -127,18 +127,21 @@ function restoreCache(paths, primaryKey, restoreKeys, options, enableCrossOsArch
+             core.info(`Cache Size: ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B)`);
+             yield (0, tar_1.extractTar)(archivePath, compressionMethod);
+             core.info('Cache restored successfully');
+-            return cacheEntry.cacheKey;
+-        }
+-        catch (error) {
+-            const typedError = error;
+-            if (typedError.name === ValidationError.name) {
+-                throw error;
+-            }
+-            else {
+-                // Supress all non-validation cache related errors because caching should be optional
+-                core.warning(`Failed to restore: ${error.message}`);
+-            }
++
++            // PATCHED - Return more inforamtion about restored entry
++            return new CacheEntry(cacheEntry.cacheKey, archiveFileSize);;
+         }
++        // PATCHED - propagate errors
++        // catch (error) {
++        //     const typedError = error;
++        //     if (typedError.name === ValidationError.name) {
++        //         throw error;
++        //     }
++        //     else {
++        //         // Supress all non-validation cache related errors because caching should be optional
++        //         core.warning(`Failed to restore: ${error.message}`);
++        //     }
++        // }
+         finally {
+             // Try to delete the archive to save space
+             try {
+@@ -206,19 +209,23 @@ function saveCache(paths, key, options, enableCrossOsArchive = false) {
+             }
+             core.debug(`Saving Cache (ID: ${cacheId})`);
+             yield cacheHttpClient.saveCache(cacheId, archivePath, options);
++
++            // PATCHED - Return more inforamtion about saved entry
++            return new CacheEntry(key, archiveFileSize);
+         }
+-        catch (error) {
+-            const typedError = error;
+-            if (typedError.name === ValidationError.name) {
+-                throw error;
+-            }
+-            else if (typedError.name === ReserveCacheError.name) {
+-                core.info(`Failed to save: ${typedError.message}`);
+-            }
+-            else {
+-                core.warning(`Failed to save: ${typedError.message}`);
+-            }
+-        }
++        // PATCHED - propagate errors
++        // catch (error) {
++        //     const typedError = error;
++        //     if (typedError.name === ValidationError.name) {
++        //         throw error;
++        //     }
++        //     else if (typedError.name === ReserveCacheError.name) {
++        //         core.info(`Failed to save: ${typedError.message}`);
++        //     }
++        //     else {
++        //         core.warning(`Failed to save: ${typedError.message}`);
++        //     }
++        // }
+         finally {
+             // Try to delete the archive to save space
+             try {
+@@ -232,4 +239,11 @@ function saveCache(paths, key, options, enableCrossOsArchive = false) {
+     });
+ }
+ exports.saveCache = saveCache;
++class CacheEntry {
++    constructor(key, size) {
++        this.key = key;
++        this.size = size;
++    }
++}
++exports.CacheEntry = CacheEntry;
+ //# sourceMappingURL=cache.js.map
+\ No newline at end of file

sources/patches/@azure+logger+1.0.4.patch

@@ -0,0 +1,48 @@
+diff --git a/node_modules/@azure/logger/dist-esm/src/debug.js b/node_modules/@azure/logger/dist-esm/src/debug.js
+index d202779..30e8313 100644
+--- a/node_modules/@azure/logger/dist-esm/src/debug.js
++++ b/node_modules/@azure/logger/dist-esm/src/debug.js
+@@ -7,7 +7,7 @@ let enabledNamespaces = [];
+ let skippedNamespaces = [];
+ const debuggers = [];
+ if (debugEnvVariable) {
+-    enable(debugEnvVariable);
++    // enable(debugEnvVariable);
+ }
+ const debugObj = Object.assign((namespace) => {
+     return createDebugger(namespace);
+diff --git a/node_modules/@azure/logger/dist-esm/src/index.js b/node_modules/@azure/logger/dist-esm/src/index.js
+index cc25720..2925db5 100644
+--- a/node_modules/@azure/logger/dist-esm/src/index.js
++++ b/node_modules/@azure/logger/dist-esm/src/index.js
+@@ -20,7 +20,7 @@ if (logLevelFromEnv) {
+         setLogLevel(logLevelFromEnv);
+     }
+     else {
+-        console.error(`AZURE_LOG_LEVEL set to unknown log level '${logLevelFromEnv}'; logging is not enabled. Acceptable values: ${AZURE_LOG_LEVELS.join(", ")}.`);
++        console.error(`AZURE_LOG_LEVEL set to unknown log level; logging is not enabled. Acceptable values: ${AZURE_LOG_LEVELS.join(", ")}.`);
+     }
+ }
+ /**
+diff --git a/node_modules/@azure/logger/dist/index.js b/node_modules/@azure/logger/dist/index.js
+index 81e97c3..a415e2f 100644
+--- a/node_modules/@azure/logger/dist/index.js
++++ b/node_modules/@azure/logger/dist/index.js
+@@ -21,7 +21,7 @@ let enabledNamespaces = [];
+ let skippedNamespaces = [];
+ const debuggers = [];
+ if (debugEnvVariable) {
+-    enable(debugEnvVariable);
++    // enable(debugEnvVariable);
+ }
+ const debugObj = Object.assign((namespace) => {
+     return createDebugger(namespace);
+@@ -125,7 +125,7 @@ if (logLevelFromEnv) {
+         setLogLevel(logLevelFromEnv);
+     }
+     else {
+-        console.error(`AZURE_LOG_LEVEL set to unknown log level '${logLevelFromEnv}'; logging is not enabled. Acceptable values: ${AZURE_LOG_LEVELS.join(", ")}.`);
++        console.error(`AZURE_LOG_LEVEL set to unknown log level; logging is not enabled. Acceptable values: ${AZURE_LOG_LEVELS.join(", ")}.`);
+     }
+ }
+ /**

sources/src/actions/dependency-submission/main.ts

@@ -0,0 +1,73 @@
+import * as core from '@actions/core'
+import * as setupGradle from '../../setup-gradle'
+import * as gradle from '../../execution/gradle'
+import * as dependencyGraph from '../../dependency-graph'
+
+import {parseArgsStringToArgv} from 'string-argv'
+import {
+    BuildScanConfig,
+    CacheConfig,
+    DependencyGraphConfig,
+    DependencyGraphOption,
+    GradleExecutionConfig,
+    setActionId,
+    WrapperValidationConfig
+} from '../../configuration'
+import {saveDeprecationState} from '../../deprecation-collector'
+import {handleMainActionError} from '../../errors'
+
+/**
+ * The main entry point for the action, called by Github Actions for the step.
+ */
+export async function run(): Promise<void> {
+    try {
+        setActionId('gradle/actions/dependency-submission')
+
+        // Configure Gradle environment (Gradle User Home)
+        await setupGradle.setup(new CacheConfig(), new BuildScanConfig(), new WrapperValidationConfig())
+
+        // Capture the enabled state of dependency-graph
+        const originallyEnabled = process.env['GITHUB_DEPENDENCY_GRAPH_ENABLED']
+
+        // Configure the dependency graph submission
+        const config = new DependencyGraphConfig()
+        await dependencyGraph.setup(config)
+
+        if (config.getDependencyGraphOption() === DependencyGraphOption.DownloadAndSubmit) {
+            // No execution to perform
+            return
+        }
+
+        // Only execute if arguments have been provided
+        const executionConfig = new GradleExecutionConfig()
+        const taskList = executionConfig.getDependencyResolutionTask()
+        const additionalArgs = executionConfig.getAdditionalArguments()
+        const executionArgs = `
+              -Dorg.gradle.configureondemand=false
+              -Dorg.gradle.dependency.verification=off
+              -Dorg.gradle.unsafe.isolated-projects=false
+              ${taskList}
+              ${additionalArgs}
+        `
+        const args: string[] = parseArgsStringToArgv(executionArgs)
+        await gradle.provisionAndMaybeExecute(
+            executionConfig.getGradleVersion(),
+            executionConfig.getBuildRootDirectory(),
+            args
+        )
+
+        await dependencyGraph.complete(config)
+
+        // Reset the enabled state of dependency graph
+        core.exportVariable('GITHUB_DEPENDENCY_GRAPH_ENABLED', originallyEnabled)
+
+        saveDeprecationState()
+    } catch (error) {
+        handleMainActionError(error)
+    }
+
+    // Explicit process.exit() to prevent waiting for hanging promises.
+    process.exit()
+}
+
+run()

sources/src/actions/dependency-submission/post.ts

@@ -0,0 +1,25 @@
+import * as setupGradle from '../../setup-gradle'
+
+import {CacheConfig, SummaryConfig} from '../../configuration'
+import {handlePostActionError} from '../../errors'
+
+// Catch and log any unhandled exceptions.  These exceptions can leak out of the uploadChunk method in
+// @actions/toolkit when a failed upload closes the file descriptor causing any in-process reads to
+// throw an uncaught exception.  Instead of failing this action, just warn.
+process.on('uncaughtException', e => handlePostActionError(e))
+
+/**
+ * The post-execution entry point for the action, called by Github Actions after completing all steps for the Job.
+ */
+export async function run(): Promise<void> {
+    try {
+        await setupGradle.complete(new CacheConfig(), new SummaryConfig())
+    } catch (error) {
+        handlePostActionError(error)
+    }
+
+    // Explicit process.exit() to prevent waiting for promises left hanging by `@actions/cache` on save.
+    process.exit()
+}
+
+run()

sources/src/actions/setup-gradle/main.ts

@@ -0,0 +1,48 @@
+import * as setupGradle from '../../setup-gradle'
+import * as provisioner from '../../execution/provision'
+import * as dependencyGraph from '../../dependency-graph'
+import {
+    BuildScanConfig,
+    CacheConfig,
+    DependencyGraphConfig,
+    GradleExecutionConfig,
+    WrapperValidationConfig,
+    getActionId,
+    setActionId
+} from '../../configuration'
+import {failOnUseOfRemovedFeature, saveDeprecationState} from '../../deprecation-collector'
+import {handleMainActionError} from '../../errors'
+
+/**
+ * The main entry point for the action, called by Github Actions for the step.
+ */
+export async function run(): Promise<void> {
+    try {
+        if (getActionId() === 'gradle/gradle-build-action') {
+            failOnUseOfRemovedFeature(
+                'The action `gradle/gradle-build-action` has been replaced by `gradle/actions/setup-gradle`'
+            )
+        }
+
+        setActionId('gradle/actions/setup-gradle')
+
+        // Configure Gradle environment (Gradle User Home)
+        await setupGradle.setup(new CacheConfig(), new BuildScanConfig(), new WrapperValidationConfig())
+
+        // Configure the dependency graph submission
+        await dependencyGraph.setup(new DependencyGraphConfig())
+
+        const config = new GradleExecutionConfig()
+        config.verifyNoArguments()
+        await provisioner.provisionGradle(config.getGradleVersion())
+
+        saveDeprecationState()
+    } catch (error) {
+        handleMainActionError(error)
+    }
+
+    // Explicit process.exit() to prevent waiting for hanging promises.
+    process.exit()
+}
+
+run()

sources/src/actions/setup-gradle/post.ts

@@ -0,0 +1,33 @@
+import * as setupGradle from '../../setup-gradle'
+import * as dependencyGraph from '../../dependency-graph'
+
+import {CacheConfig, DependencyGraphConfig, SummaryConfig} from '../../configuration'
+import {handlePostActionError} from '../../errors'
+import {emitDeprecationWarnings, restoreDeprecationState} from '../../deprecation-collector'
+
+// Catch and log any unhandled exceptions.  These exceptions can leak out of the uploadChunk method in
+// @actions/toolkit when a failed upload closes the file descriptor causing any in-process reads to
+// throw an uncaught exception.  Instead of failing this action, just warn.
+process.on('uncaughtException', e => handlePostActionError(e))
+
+/**
+ * The post-execution entry point for the action, called by Github Actions after completing all steps for the Job.
+ */
+export async function run(): Promise<void> {
+    try {
+        restoreDeprecationState()
+        emitDeprecationWarnings()
+
+        if (await setupGradle.complete(new CacheConfig(), new SummaryConfig())) {
+            // Only submit the dependency graphs once per job
+            await dependencyGraph.complete(new DependencyGraphConfig())
+        }
+    } catch (error) {
+        handlePostActionError(error)
+    }
+
+    // Explicit process.exit() to prevent waiting for promises left hanging by `@actions/cache` on save.
+    process.exit()
+}
+
+run()

sources/src/actions/wrapper-validation/main.ts

@@ -0,0 +1,50 @@
+import * as path from 'path'
+import * as core from '@actions/core'
+
+import * as validate from '../../wrapper-validation/validate'
+import {getActionId, setActionId} from '../../configuration'
+import {failOnUseOfRemovedFeature, emitDeprecationWarnings} from '../../deprecation-collector'
+import {handleMainActionError} from '../../errors'
+
+export async function run(): Promise<void> {
+    try {
+        if (getActionId() === 'gradle/wrapper-validation-action') {
+            failOnUseOfRemovedFeature(
+                'The action `gradle/wrapper-validation-action` has been replaced by `gradle/actions/wrapper-validation`'
+            )
+        }
+
+        setActionId('gradle/actions/wrapper-validation')
+
+        const result = await validate.findInvalidWrapperJars(
+            path.resolve('.'),
+            core.getInput('allow-snapshots') === 'true',
+            core.getInput('allow-checksums').split(',')
+        )
+        if (result.isValid()) {
+            core.info(result.toDisplayString())
+
+            const minWrapperCount = +core.getInput('min-wrapper-count')
+            if (result.valid.length < minWrapperCount) {
+                const message =
+                    result.valid.length === 0
+                        ? 'Wrapper validation failed: no Gradle Wrapper jars found. Did you forget to checkout the repository?'
+                        : `Wrapper validation failed: expected at least ${minWrapperCount} Gradle Wrapper jars, but found ${result.valid.length}.`
+                core.setFailed(message)
+            }
+        } else {
+            core.setFailed(
+                `At least one Gradle Wrapper Jar failed validation!\n  See https://github.com/gradle/actions/blob/main/docs/wrapper-validation.md#validation-failures\n${result.toDisplayString()}`
+            )
+            if (result.invalid.length > 0) {
+                core.setOutput('failed-wrapper', `${result.invalid.map(w => w.path).join('|')}`)
+            }
+        }
+
+        emitDeprecationWarnings(false)
+    } catch (error) {
+        handleMainActionError(error)
+    }
+}
+
+run()

sources/src/build-results.ts

@@ -0,0 +1,91 @@
+import * as fs from 'fs'
+import * as path from 'path'
+
+export interface BuildResult {
+    get rootProjectName(): string
+    get rootProjectDir(): string
+    get requestedTasks(): string
+    get gradleVersion(): string
+    get gradleHomeDir(): string
+    get buildFailed(): boolean
+    get configCacheHit(): boolean
+    get buildScanUri(): string
+    get buildScanFailed(): boolean
+}
+
+export class BuildResults {
+    results: BuildResult[]
+
+    constructor(results: BuildResult[]) {
+        this.results = results
+    }
+
+    anyFailed(): boolean {
+        return this.results.some(result => result.buildFailed)
+    }
+
+    anyConfigCacheHit(): boolean {
+        return this.results.some(result => result.configCacheHit)
+    }
+
+    uniqueGradleHomes(): string[] {
+        const allHomes = this.results.map(buildResult => buildResult.gradleHomeDir)
+        return Array.from(new Set(allHomes))
+    }
+}
+
+export function loadBuildResults(): BuildResults {
+    const results = getUnprocessedResults().map(filePath => {
+        const content = fs.readFileSync(filePath, 'utf8')
+        const buildResult = JSON.parse(content) as BuildResult
+        addScanResults(filePath, buildResult)
+        return buildResult
+    })
+    return new BuildResults(results)
+}
+
+export function markBuildResultsProcessed(): void {
+    getUnprocessedResults().forEach(markProcessed)
+}
+
+function getUnprocessedResults(): string[] {
+    const buildResultsDir = path.resolve(process.env['RUNNER_TEMP']!, '.gradle-actions', 'build-results')
+    if (!fs.existsSync(buildResultsDir)) {
+        return []
+    }
+
+    return fs
+        .readdirSync(buildResultsDir)
+        .map(file => {
+            return path.resolve(buildResultsDir, file)
+        })
+        .filter(filePath => {
+            return path.extname(filePath) === '.json' && !isProcessed(filePath)
+        })
+}
+
+function addScanResults(buildResultsFile: string, buildResult: BuildResult): void {
+    const buildScansDir = path.resolve(process.env['RUNNER_TEMP']!, '.gradle-actions', 'build-scans')
+    if (!fs.existsSync(buildScansDir)) {
+        return
+    }
+
+    const buildScanResults = path.resolve(buildScansDir, path.basename(buildResultsFile))
+    if (fs.existsSync(buildScanResults)) {
+        const content = fs.readFileSync(buildScanResults, 'utf8')
+        const scanResults = JSON.parse(content)
+        Object.assign(buildResult, scanResults)
+    }
+
+    return
+}
+
+function isProcessed(resultFile: string): boolean {
+    const markerFile = `${resultFile}.processed`
+    return fs.existsSync(markerFile)
+}
+
+function markProcessed(resultFile: string): void {
+    const markerFile = `${resultFile}.processed`
+    fs.writeFileSync(markerFile, '')
+}

sources/src/caching/cache-cleaner.ts

@@ -0,0 +1,88 @@
+import * as core from '@actions/core'
+import * as exec from '@actions/exec'
+
+import fs from 'fs'
+import path from 'path'
+import * as provisioner from '../execution/provision'
+
+export class CacheCleaner {
+    private readonly gradleUserHome: string
+    private readonly tmpDir: string
+
+    constructor(gradleUserHome: string, tmpDir: string) {
+        this.gradleUserHome = gradleUserHome
+        this.tmpDir = tmpDir
+    }
+
+    async prepare(): Promise<string> {
+        // Save the current timestamp
+        const timestamp = Date.now().toString()
+        core.saveState('clean-timestamp', timestamp)
+        return timestamp
+    }
+
+    async forceCleanup(): Promise<void> {
+        const cleanTimestamp = core.getState('clean-timestamp')
+        await this.forceCleanupFilesOlderThan(cleanTimestamp)
+    }
+
+    // Visible for testing
+    async forceCleanupFilesOlderThan(cleanTimestamp: string): Promise<void> {
+        // Run a dummy Gradle build to trigger cache cleanup
+        const cleanupProjectDir = path.resolve(this.tmpDir, 'dummy-cleanup-project')
+        fs.mkdirSync(cleanupProjectDir, {recursive: true})
+        fs.writeFileSync(
+            path.resolve(cleanupProjectDir, 'settings.gradle'),
+            'rootProject.name = "dummy-cleanup-project"'
+        )
+        fs.writeFileSync(
+            path.resolve(cleanupProjectDir, 'init.gradle'),
+            `
+            beforeSettings { settings ->
+                def cleanupTime = ${cleanTimestamp}
+            
+                settings.caches {
+                    cleanup = Cleanup.ALWAYS
+            
+                    releasedWrappers.removeUnusedEntriesOlderThan.set(cleanupTime)
+                    snapshotWrappers.removeUnusedEntriesOlderThan.set(cleanupTime)
+                    downloadedResources.removeUnusedEntriesOlderThan.set(cleanupTime)
+                    createdResources.removeUnusedEntriesOlderThan.set(cleanupTime)
+                    buildCache.removeUnusedEntriesOlderThan.set(cleanupTime)
+                }
+            }
+            `
+        )
+        fs.writeFileSync(path.resolve(cleanupProjectDir, 'build.gradle'), 'task("noop") {}')
+
+        // Gradle >= 8.9 required for cache cleanup
+        const executable = await provisioner.provisionGradleAtLeast('8.9')
+
+        await core.group('Executing Gradle to clean up caches', async () => {
+            core.info(`Cleaning up caches last used before ${cleanTimestamp}`)
+            await this.executeCleanupBuild(executable, cleanupProjectDir)
+        })
+    }
+
+    private async executeCleanupBuild(executable: string, cleanupProjectDir: string): Promise<void> {
+        const args = [
+            '-g',
+            this.gradleUserHome,
+            '-I',
+            'init.gradle',
+            '--info',
+            '--no-daemon',
+            '--no-scan',
+            '--build-cache',
+            '-DGITHUB_DEPENDENCY_GRAPH_ENABLED=false',
+            'noop'
+        ]
+
+        const result = await exec.getExecOutput(executable, args, {
+            cwd: cleanupProjectDir,
+            silent: true
+        })
+
+        core.info(result.stdout)
+    }
+}

sources/src/caching/cache-key.ts

@@ -0,0 +1,100 @@
+import * as github from '@actions/github'
+
+import {CacheConfig, getJobMatrix} from '../configuration'
+import {hashStrings} from './cache-utils'
+
+const CACHE_PROTOCOL_VERSION = 'v1'
+
+const CACHE_KEY_PREFIX_VAR = 'GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX'
+const CACHE_KEY_OS_VAR = 'GRADLE_BUILD_ACTION_CACHE_KEY_ENVIRONMENT'
+const CACHE_KEY_JOB_VAR = 'GRADLE_BUILD_ACTION_CACHE_KEY_JOB'
+const CACHE_KEY_JOB_INSTANCE_VAR = 'GRADLE_BUILD_ACTION_CACHE_KEY_JOB_INSTANCE'
+const CACHE_KEY_JOB_EXECUTION_VAR = 'GRADLE_BUILD_ACTION_CACHE_KEY_JOB_EXECUTION'
+
+/**
+ * Represents a key used to restore a cache entry.
+ * The Github Actions cache will first try for an exact match on the key.
+ * If that fails, it will try for a prefix match on any of the restoreKeys.
+ */
+export class CacheKey {
+    key: string
+    restoreKeys: string[]
+
+    constructor(key: string, restoreKeys: string[]) {
+        this.key = key
+        this.restoreKeys = restoreKeys
+    }
+}
+
+/**
+ * Generates a cache key specific to the current job execution.
+ * The key is constructed from the following inputs (with some user overrides):
+ * - The cache key prefix: defaults to 'gradle-' but can be overridden by the user
+ * - The cache protocol version
+ * - The runner operating system
+ * - The name of the workflow and Job being executed
+ * - The matrix values for the Job being executed (job context)
+ * - The SHA of the commit being executed
+ *
+ * Caches are restored by trying to match the these key prefixes in order:
+ * - The full key with SHA
+ * - A previous key for this Job + matrix
+ * - Any previous key for this Job (any matrix)
+ * - Any previous key for this cache on the current OS
+ */
+export function generateCacheKey(cacheName: string, config: CacheConfig): CacheKey {
+    const prefix = process.env[CACHE_KEY_PREFIX_VAR] || ''
+
+    const cacheKeyBase = `${prefix}${getCacheKeyBase(cacheName, CACHE_PROTOCOL_VERSION)}`
+
+    // At the most general level, share caches for all executions on the same OS
+    const cacheKeyForEnvironment = `${cacheKeyBase}|${getCacheKeyEnvironment()}`
+
+    // Then prefer caches that run job with the same ID
+    const cacheKeyForJob = `${cacheKeyForEnvironment}|${getCacheKeyJob()}`
+
+    // Prefer (even more) jobs that run this job in the same workflow with the same context (matrix)
+    const cacheKeyForJobContext = `${cacheKeyForJob}[${getCacheKeyJobInstance()}]`
+
+    // Exact match on Git SHA
+    const cacheKey = `${cacheKeyForJobContext}-${getCacheKeyJobExecution()}`
+
+    if (config.isCacheStrictMatch()) {
+        return new CacheKey(cacheKey, [cacheKeyForJobContext])
+    }
+
+    return new CacheKey(cacheKey, [cacheKeyForJobContext, cacheKeyForJob, cacheKeyForEnvironment])
+}
+
+export function getCacheKeyBase(cacheName: string, cacheProtocolVersion: string): string {
+    // Prefix can be used to force change all cache keys (defaults to cache protocol version)
+    return `gradle-${cacheName}-${cacheProtocolVersion}`
+}
+
+function getCacheKeyEnvironment(): string {
+    const runnerOs = process.env['RUNNER_OS'] || ''
+    const runnerArch = process.env['RUNNER_ARCH'] || ''
+    return process.env[CACHE_KEY_OS_VAR] || `${runnerOs}-${runnerArch}`
+}
+
+function getCacheKeyJob(): string {
+    return process.env[CACHE_KEY_JOB_VAR] || github.context.job
+}
+
+function getCacheKeyJobInstance(): string {
+    const override = process.env[CACHE_KEY_JOB_INSTANCE_VAR]
+    if (override) {
+        return override
+    }
+
+    // By default, we hash the workflow name and the full `matrix` data for the run, to uniquely identify this job invocation
+    // The only way we can obtain the `matrix` data is via the `workflow-job-context` parameter in action.yml.
+    const workflowName = github.context.workflow
+    const workflowJobContext = getJobMatrix()
+    return hashStrings([workflowName, workflowJobContext])
+}
+
+function getCacheKeyJobExecution(): string {
+    // Used to associate a cache key with a particular execution (default is bound to the git commit sha)
+    return process.env[CACHE_KEY_JOB_EXECUTION_VAR] || github.context.sha
+}

sources/src/caching/cache-reporting.ts

@@ -0,0 +1,294 @@
+import * as cache from '@actions/cache'
+
+export const DEFAULT_CACHE_ENABLED_REASON = `[Cache was enabled](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#caching-build-state-between-jobs). Action attempted to both restore and save the Gradle User Home.`
+
+export const DEFAULT_READONLY_REASON = `[Cache was read-only](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#using-the-cache-read-only). By default, the action will only write to the cache for Jobs running on the default branch.`
+
+export const DEFAULT_DISABLED_REASON = `[Cache was disabled](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#disabling-caching) via action confiugration. Gradle User Home was not restored from or saved to the cache.`
+
+export const DEFAULT_WRITEONLY_REASON = `[Cache was set to write-only](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#using-the-cache-write-only) via action configuration. Gradle User Home was not restored from cache.`
+
+export const EXISTING_GRADLE_HOME = `[Cache was disabled to avoid overwriting a pre-existing Gradle User Home](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#overwriting-an-existing-gradle-user-home). Gradle User Home was not restored from or saved to the cache.`
+
+export const CLEANUP_DISABLED_READONLY = `[Cache cleanup](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#configuring-cache-cleanup) is always disabled when cache is read-only or disabled.`
+
+export const DEFAULT_CLEANUP_ENABLED_REASON = `[Cache cleanup](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#configuring-cache-cleanup) was enabled. Stale files in Gradle User Home were purged before saving to the cache.`
+
+export const DEFAULT_CLEANUP_DISABLED_REASON = `[Cache cleanup](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#configuring-cache-cleanup) was disabled via action parameter. No cleanup of Gradle User Home was performed.`
+
+export const CLEANUP_DISABLED_DUE_TO_FAILURE =
+    '[Cache cleanup was disabled due to build failure](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#configuring-cache-cleanup). Use `cache-cleanup: always` to override this behavior.'
+
+export const CLEANUP_DISABLED_DUE_TO_CONFIG_CACHE_HIT =
+    '[Cache cleanup was disabled due to configuration-cache reuse](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#configuring-cache-cleanup). This is expected.'
+
+/**
+ * Collects information on what entries were saved and restored during the action.
+ * This information is used to generate a summary of the cache usage.
+ */
+export class CacheListener {
+    cacheEntries: CacheEntryListener[] = []
+    cacheReadOnly = false
+    cacheWriteOnly = false
+    cacheDisabled = false
+    cacheStatusReason: string = DEFAULT_CACHE_ENABLED_REASON
+    cacheCleanupMessage: string = DEFAULT_CLEANUP_DISABLED_REASON
+
+    get fullyRestored(): boolean {
+        return this.cacheEntries.every(x => !x.wasRequestedButNotRestored())
+    }
+
+    get cacheStatus(): string {
+        if (!cache.isFeatureAvailable()) return 'not available'
+        if (this.cacheDisabled) return 'disabled'
+        if (this.cacheWriteOnly) return 'write-only'
+        if (this.cacheReadOnly) return 'read-only'
+        return 'enabled'
+    }
+
+    setReadOnly(reason: string = DEFAULT_READONLY_REASON): void {
+        this.cacheReadOnly = true
+        this.cacheStatusReason = reason
+        this.cacheCleanupMessage = CLEANUP_DISABLED_READONLY
+    }
+
+    setDisabled(reason: string = DEFAULT_DISABLED_REASON): void {
+        this.cacheDisabled = true
+        this.cacheStatusReason = reason
+        this.cacheCleanupMessage = CLEANUP_DISABLED_READONLY
+    }
+
+    setWriteOnly(reason: string = DEFAULT_WRITEONLY_REASON): void {
+        this.cacheWriteOnly = true
+        this.cacheStatusReason = reason
+    }
+
+    setCacheCleanupEnabled(): void {
+        this.cacheCleanupMessage = DEFAULT_CLEANUP_ENABLED_REASON
+    }
+
+    setCacheCleanupDisabled(reason: string = DEFAULT_CLEANUP_DISABLED_REASON): void {
+        this.cacheCleanupMessage = reason
+    }
+
+    entry(name: string): CacheEntryListener {
+        for (const entry of this.cacheEntries) {
+            if (entry.entryName === name) {
+                return entry
+            }
+        }
+
+        const newEntry = new CacheEntryListener(name)
+        this.cacheEntries.push(newEntry)
+        return newEntry
+    }
+
+    stringify(): string {
+        return JSON.stringify(this)
+    }
+
+    static rehydrate(stringRep: string): CacheListener {
+        if (stringRep === '') {
+            return new CacheListener()
+        }
+        const rehydrated: CacheListener = Object.assign(new CacheListener(), JSON.parse(stringRep))
+        const entries = rehydrated.cacheEntries
+        for (let index = 0; index < entries.length; index++) {
+            const rawEntry = entries[index]
+            entries[index] = Object.assign(new CacheEntryListener(rawEntry.entryName), rawEntry)
+        }
+        return rehydrated
+    }
+}
+
+/**
+ * Collects information on the state of a single cache entry.
+ */
+export class CacheEntryListener {
+    entryName: string
+    requestedKey: string | undefined
+    requestedRestoreKeys: string[] | undefined
+    restoredKey: string | undefined
+    restoredSize: number | undefined
+    restoredTime: number | undefined
+    notRestored: string | undefined
+
+    savedKey: string | undefined
+    savedSize: number | undefined
+    savedTime: number | undefined
+    notSaved: string | undefined
+
+    constructor(entryName: string) {
+        this.entryName = entryName
+    }
+
+    wasRequestedButNotRestored(): boolean {
+        return this.requestedKey !== undefined && this.restoredKey === undefined
+    }
+
+    markRequested(key: string, restoreKeys: string[] = []): CacheEntryListener {
+        this.requestedKey = key
+        this.requestedRestoreKeys = restoreKeys
+        return this
+    }
+
+    markRestored(key: string, size: number | undefined, time: number): CacheEntryListener {
+        this.restoredKey = key
+        this.restoredSize = size
+        this.restoredTime = time
+        return this
+    }
+
+    markNotRestored(message: string): CacheEntryListener {
+        this.notRestored = message
+        return this
+    }
+
+    markSaved(key: string, size: number | undefined, time: number): CacheEntryListener {
+        this.savedKey = key
+        this.savedSize = size
+        this.savedTime = time
+        return this
+    }
+
+    markAlreadyExists(key: string): CacheEntryListener {
+        this.savedKey = key
+        this.savedSize = 0
+        return this
+    }
+
+    markNotSaved(message: string): CacheEntryListener {
+        this.notSaved = message
+        return this
+    }
+}
+
+export function generateCachingReport(listener: CacheListener): string {
+    const entries = listener.cacheEntries
+
+    return `
+<details>
+<summary><h4>Caching for Gradle actions was ${listener.cacheStatus} - expand for details</h4></summary>
+
+- ${listener.cacheStatusReason}
+- ${listener.cacheCleanupMessage}
+
+${renderEntryTable(entries)}
+
+<h5>Cache Entry Details</h5>
+<pre>
+    ${renderEntryDetails(listener)}
+</pre>
+</details>
+    `
+}
+
+function renderEntryTable(entries: CacheEntryListener[]): string {
+    return `
+<table>
+    <tr><td></td><th>Count</th><th>Total Size (Mb)</th><th>Total Time (ms)</tr>
+    <tr><td>Entries Restored</td>
+        <td>${getCount(entries, e => e.restoredSize)}</td>
+        <td>${getSize(entries, e => e.restoredSize)}</td>
+        <td>${getTime(entries, e => e.restoredTime)}</td>
+    </tr>
+    <tr><td>Entries Saved</td>
+        <td>${getCount(entries, e => e.savedSize)}</td>
+        <td>${getSize(entries, e => e.savedSize)}</td>
+        <td>${getTime(entries, e => e.savedTime)}</td>
+    </tr>
+</table>
+    `
+}
+
+function renderEntryDetails(listener: CacheListener): string {
+    return listener.cacheEntries
+        .map(
+            entry => `Entry: ${entry.entryName}
+    Requested Key : ${entry.requestedKey ?? ''}
+    Restored  Key : ${entry.restoredKey ?? ''}
+              Size: ${formatSize(entry.restoredSize)}
+              Time: ${formatTime(entry.restoredTime)}
+              ${getRestoredMessage(entry, listener.cacheWriteOnly)}
+    Saved     Key : ${entry.savedKey ?? ''}
+              Size: ${formatSize(entry.savedSize)}
+              Time: ${formatTime(entry.savedTime)}
+              ${getSavedMessage(entry, listener.cacheReadOnly)}
+`
+        )
+        .join('---\n')
+}
+
+function getRestoredMessage(entry: CacheEntryListener, cacheWriteOnly: boolean): string {
+    if (entry.notRestored) {
+        return `(Entry not restored: ${entry.notRestored})`
+    }
+    if (cacheWriteOnly) {
+        return '(Entry not restored: cache is write-only)'
+    }
+    if (entry.requestedKey === undefined) {
+        return '(Entry not restored: not requested)'
+    }
+    if (entry.restoredKey === undefined) {
+        return '(Entry not restored: no match found)'
+    }
+    if (entry.restoredKey === entry.requestedKey) {
+        return '(Entry restored: exact match found)'
+    }
+    return '(Entry restored: partial match found)'
+}
+
+function getSavedMessage(entry: CacheEntryListener, cacheReadOnly: boolean): string {
+    if (entry.notSaved) {
+        return `(Entry not saved: ${entry.notSaved})`
+    }
+    if (entry.savedKey === undefined) {
+        if (cacheReadOnly) {
+            return '(Entry not saved: cache is read-only)'
+        }
+        if (entry.notRestored) {
+            return '(Entry not saved: not restored)'
+        }
+        return '(Entry not saved: reason unknown)'
+    }
+    if (entry.savedSize === 0) {
+        return '(Entry not saved: entry with key already exists)'
+    }
+    return '(Entry saved)'
+}
+
+function getCount(
+    cacheEntries: CacheEntryListener[],
+    predicate: (value: CacheEntryListener) => number | undefined
+): number {
+    return cacheEntries.filter(e => predicate(e)).length
+}
+
+function getSize(
+    cacheEntries: CacheEntryListener[],
+    predicate: (value: CacheEntryListener) => number | undefined
+): number {
+    const bytes = cacheEntries.map(e => predicate(e) ?? 0).reduce((p, v) => p + v, 0)
+    return Math.round(bytes / (1024 * 1024))
+}
+
+function getTime(
+    cacheEntries: CacheEntryListener[],
+    predicate: (value: CacheEntryListener) => number | undefined
+): number {
+    return cacheEntries.map(e => predicate(e) ?? 0).reduce((p, v) => p + v, 0)
+}
+
+function formatSize(bytes: number | undefined): string {
+    if (bytes === undefined || bytes === 0) {
+        return ''
+    }
+    return `${Math.round(bytes / (1024 * 1024))} MB (${bytes} B)`
+}
+
+function formatTime(ms: number | undefined): string {
+    if (ms === undefined || ms === 0) {
+        return ''
+    }
+    return `${ms} ms`
+}

sources/src/caching/cache-utils.ts

@@ -0,0 +1,140 @@
+import * as core from '@actions/core'
+import * as cache from '@actions/cache'
+import * as exec from '@actions/exec'
+
+import * as crypto from 'crypto'
+import * as path from 'path'
+import * as fs from 'fs'
+
+import {CacheEntryListener} from './cache-reporting'
+
+const SEGMENT_DOWNLOAD_TIMEOUT_VAR = 'SEGMENT_DOWNLOAD_TIMEOUT_MINS'
+const SEGMENT_DOWNLOAD_TIMEOUT_DEFAULT = 10 * 60 * 1000 // 10 minutes
+
+export function isCacheDebuggingEnabled(): boolean {
+    if (core.isDebug()) {
+        return true
+    }
+    return process.env['GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED'] ? true : false
+}
+
+export function hashFileNames(fileNames: string[]): string {
+    return hashStrings(fileNames.map(x => x.replace(new RegExp(`\\${path.sep}`, 'g'), '/')))
+}
+
+export function hashStrings(values: string[]): string {
+    const hash = crypto.createHash('md5')
+    for (const value of values) {
+        hash.update(value)
+    }
+    return hash.digest('hex')
+}
+
+export async function restoreCache(
+    cachePath: string[],
+    cacheKey: string,
+    cacheRestoreKeys: string[],
+    listener: CacheEntryListener
+): Promise<cache.CacheEntry | undefined> {
+    listener.markRequested(cacheKey, cacheRestoreKeys)
+    try {
+        const startTime = Date.now()
+        // Only override the read timeout if the SEGMENT_DOWNLOAD_TIMEOUT_MINS env var has NOT been set
+        const cacheRestoreOptions = process.env[SEGMENT_DOWNLOAD_TIMEOUT_VAR]
+            ? {}
+            : {segmentTimeoutInMs: SEGMENT_DOWNLOAD_TIMEOUT_DEFAULT}
+        const restoredEntry = await cache.restoreCache(cachePath, cacheKey, cacheRestoreKeys, cacheRestoreOptions)
+        if (restoredEntry !== undefined) {
+            const restoreTime = Date.now() - startTime
+            listener.markRestored(restoredEntry.key, restoredEntry.size, restoreTime)
+            core.info(`Restored cache entry with key ${cacheKey} to ${cachePath.join()} in ${restoreTime}ms`)
+        }
+        return restoredEntry
+    } catch (error) {
+        listener.markNotRestored((error as Error).message)
+        handleCacheFailure(error, `Failed to restore ${cacheKey}`)
+        return undefined
+    }
+}
+
+export async function saveCache(cachePath: string[], cacheKey: string, listener: CacheEntryListener): Promise<void> {
+    try {
+        const startTime = Date.now()
+        const savedEntry = await cache.saveCache(cachePath, cacheKey)
+        const saveTime = Date.now() - startTime
+        listener.markSaved(savedEntry.key, savedEntry.size, saveTime)
+        core.info(`Saved cache entry with key ${cacheKey} from ${cachePath.join()} in ${saveTime}ms`)
+    } catch (error) {
+        if (error instanceof cache.ReserveCacheError) {
+            listener.markAlreadyExists(cacheKey)
+        } else {
+            listener.markNotSaved((error as Error).message)
+        }
+        handleCacheFailure(error, `Failed to save cache entry with path '${cachePath}' and key: ${cacheKey}`)
+    }
+}
+
+export function cacheDebug(message: string): void {
+    if (isCacheDebuggingEnabled()) {
+        core.info(message)
+    } else {
+        core.debug(message)
+    }
+}
+
+export function handleCacheFailure(error: unknown, message: string): void {
+    if (error instanceof cache.ValidationError) {
+        // Fail on cache validation errors
+        throw error
+    }
+    if (error instanceof cache.ReserveCacheError) {
+        // Reserve cache errors are expected if the artifact has been previously cached
+        core.info(`${message}: ${error}`)
+    } else {
+        // Warn on all other errors
+        core.warning(`${message}: ${error}`)
+        if (error instanceof Error && error.stack) {
+            cacheDebug(error.stack)
+        }
+    }
+}
+
+/**
+ * Attempt to delete a file or directory, waiting to allow locks to be released
+ */
+export async function tryDelete(file: string): Promise<void> {
+    const maxAttempts = 5
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        if (!fs.existsSync(file)) {
+            return
+        }
+        try {
+            const stat = fs.lstatSync(file)
+            if (stat.isDirectory()) {
+                fs.rmSync(file, {recursive: true})
+            } else {
+                fs.unlinkSync(file)
+            }
+            return
+        } catch (error) {
+            if (attempt === maxAttempts) {
+                core.warning(`Failed to delete ${file}, which will impact caching. 
+It is likely locked by another process. Output of 'jps -ml':
+${await getJavaProcesses()}`)
+                throw error
+            } else {
+                cacheDebug(`Attempt to delete ${file} failed. Will try again.`)
+                await delay(1000)
+            }
+        }
+    }
+}
+
+async function delay(ms: number): Promise<void> {
+    return new Promise(resolve => setTimeout(resolve, ms))
+}
+
+async function getJavaProcesses(): Promise<string> {
+    const jpsOutput = await exec.getExecOutput('jps', ['-lm'])
+    return jpsOutput.stdout
+}

sources/src/caching/caches.ts

@@ -0,0 +1,124 @@
+import * as core from '@actions/core'
+import {
+    CacheListener,
+    EXISTING_GRADLE_HOME,
+    CLEANUP_DISABLED_DUE_TO_FAILURE,
+    CLEANUP_DISABLED_DUE_TO_CONFIG_CACHE_HIT
+} from './cache-reporting'
+import {GradleUserHomeCache} from './gradle-user-home-cache'
+import {CacheCleaner} from './cache-cleaner'
+import {DaemonController} from '../daemon-controller'
+import {CacheConfig} from '../configuration'
+import {BuildResults} from '../build-results'
+
+const CACHE_RESTORED_VAR = 'GRADLE_BUILD_ACTION_CACHE_RESTORED'
+
+export async function restore(
+    userHome: string,
+    gradleUserHome: string,
+    cacheListener: CacheListener,
+    cacheConfig: CacheConfig
+): Promise<void> {
+    // Bypass restore cache on all but first action step in workflow.
+    if (process.env[CACHE_RESTORED_VAR]) {
+        core.info('Cache only restored on first action step.')
+        return
+    }
+    core.exportVariable(CACHE_RESTORED_VAR, true)
+
+    const gradleStateCache = new GradleUserHomeCache(userHome, gradleUserHome, cacheConfig)
+
+    if (cacheConfig.isCacheDisabled()) {
+        core.info('Cache is disabled: will not restore state from previous builds.')
+        // Initialize the Gradle User Home even when caching is disabled.
+        gradleStateCache.init()
+        cacheListener.setDisabled()
+        return
+    }
+
+    if (gradleStateCache.cacheOutputExists()) {
+        if (!cacheConfig.isCacheOverwriteExisting()) {
+            core.info('Gradle User Home already exists: will not restore from cache.')
+            // Initialize pre-existing Gradle User Home.
+            gradleStateCache.init()
+            cacheListener.setDisabled(EXISTING_GRADLE_HOME)
+            return
+        }
+        core.info('Gradle User Home already exists: will overwrite with cached contents.')
+    }
+
+    gradleStateCache.init()
+    // Mark the state as restored so that post-action will perform save.
+    core.saveState(CACHE_RESTORED_VAR, true)
+
+    if (cacheConfig.isCacheCleanupEnabled()) {
+        core.info('Preparing cache for cleanup.')
+        const cacheCleaner = new CacheCleaner(gradleUserHome, process.env['RUNNER_TEMP']!)
+        await cacheCleaner.prepare()
+    }
+
+    if (cacheConfig.isCacheWriteOnly()) {
+        core.info('Cache is write-only: will not restore from cache.')
+        cacheListener.setWriteOnly()
+        return
+    }
+
+    await core.group('Restore Gradle state from cache', async () => {
+        await gradleStateCache.restore(cacheListener)
+    })
+}
+
+export async function save(
+    userHome: string,
+    gradleUserHome: string,
+    cacheListener: CacheListener,
+    daemonController: DaemonController,
+    buildResults: BuildResults,
+    cacheConfig: CacheConfig
+): Promise<void> {
+    if (cacheConfig.isCacheDisabled()) {
+        core.info('Cache is disabled: will not save state for later builds.')
+        return
+    }
+
+    if (!core.getState(CACHE_RESTORED_VAR)) {
+        core.info('Cache will not be saved: not restored in main action step.')
+        return
+    }
+
+    if (cacheConfig.isCacheReadOnly()) {
+        core.info('Cache is read-only: will not save state for use in subsequent builds.')
+        cacheListener.setReadOnly()
+        return
+    }
+
+    await core.group('Stopping Gradle daemons', async () => {
+        await daemonController.stopAllDaemons()
+    })
+
+    if (cacheConfig.isCacheCleanupEnabled()) {
+        if (buildResults.anyConfigCacheHit()) {
+            core.info('Not performing cache-cleanup due to config-cache reuse')
+            cacheListener.setCacheCleanupDisabled(CLEANUP_DISABLED_DUE_TO_CONFIG_CACHE_HIT)
+        } else if (cacheConfig.shouldPerformCacheCleanup(buildResults.anyFailed())) {
+            cacheListener.setCacheCleanupEnabled()
+            await performCacheCleanup(gradleUserHome)
+        } else {
+            core.info('Not performing cache-cleanup due to build failure')
+            cacheListener.setCacheCleanupDisabled(CLEANUP_DISABLED_DUE_TO_FAILURE)
+        }
+    }
+
+    await core.group('Caching Gradle state', async () => {
+        return new GradleUserHomeCache(userHome, gradleUserHome, cacheConfig).save(cacheListener)
+    })
+}
+
+async function performCacheCleanup(gradleUserHome: string): Promise<void> {
+    const cacheCleaner = new CacheCleaner(gradleUserHome, process.env['RUNNER_TEMP']!)
+    try {
+        await cacheCleaner.forceCleanup()
+    } catch (e) {
+        core.warning(`Cache cleanup failed. Will continue. ${String(e)}`)
+    }
+}

sources/src/caching/gradle-home-extry-extractor.ts

@@ -0,0 +1,467 @@
+import path from 'path'
+import fs from 'fs'
+import * as core from '@actions/core'
+import * as glob from '@actions/glob'
+
+import {CacheEntryListener, CacheListener} from './cache-reporting'
+import {cacheDebug, hashFileNames, isCacheDebuggingEnabled, restoreCache, saveCache, tryDelete} from './cache-utils'
+
+import {BuildResult, loadBuildResults} from '../build-results'
+import {CacheConfig, ACTION_METADATA_DIR} from '../configuration'
+import {getCacheKeyBase} from './cache-key'
+import {versionIsAtLeast} from '../execution/gradle'
+
+const SKIP_RESTORE_VAR = 'GRADLE_BUILD_ACTION_SKIP_RESTORE'
+const CACHE_PROTOCOL_VERSION = 'v1'
+
+/**
+ * Represents the result of attempting to load or store an extracted cache entry.
+ * An undefined cacheKey indicates that the operation did not succeed.
+ * The collected results are then used to populate the `cache-metadata.json` file for later use.
+ */
+class ExtractedCacheEntry {
+    artifactType: string
+    pattern: string
+    cacheKey: string | undefined
+
+    constructor(artifactType: string, pattern: string, cacheKey: string | undefined) {
+        this.artifactType = artifactType
+        this.pattern = pattern
+        this.cacheKey = cacheKey
+    }
+}
+
+/**
+ * Representation of all of the extracted cache entries for this Gradle User Home.
+ * This object is persisted to JSON file in the Gradle User Home directory for storing,
+ * and subsequently used to restore the Gradle User Home.
+ */
+class ExtractedCacheEntryMetadata {
+    entries: ExtractedCacheEntry[] = []
+}
+
+/**
+ * The specification for a type of extracted cache entry.
+ */
+class ExtractedCacheEntryDefinition {
+    artifactType: string
+    pattern: string
+    bundle: boolean
+    uniqueFileNames = true
+    notCacheableReason: string | undefined
+
+    constructor(artifactType: string, pattern: string, bundle: boolean) {
+        this.artifactType = artifactType
+        this.pattern = pattern
+        this.bundle = bundle
+    }
+
+    /**
+     * Indicate that the file names matching the cache entry pattern are NOT sufficient to uniquely identify the contents.
+     * If the file names are sufficient, then we use a hash of the file names to identify the entry.
+     * With non-unique-file-names, we hash the file contents to identify the cache entry.
+     */
+    withNonUniqueFileNames(): ExtractedCacheEntryDefinition {
+        this.uniqueFileNames = false
+        return this
+    }
+
+    /**
+     * Specify that the cache entry, should not be saved for some reason, even though the contents exist.
+     * This is used to prevent configuration-cache entries being cached when they were generated by Gradle < 8.6,
+     */
+    notCacheableBecause(reason: string): ExtractedCacheEntryDefinition {
+        this.notCacheableReason = reason
+        return this
+    }
+}
+
+/**
+ * Caches and restores the entire Gradle User Home directory, extracting entries containing common artifacts
+ * for more efficient storage.
+ */
+abstract class AbstractEntryExtractor {
+    protected readonly cacheConfig: CacheConfig
+    protected readonly gradleUserHome: string
+    private extractorName: string
+
+    constructor(gradleUserHome: string, extractorName: string, cacheConfig: CacheConfig) {
+        this.gradleUserHome = gradleUserHome
+        this.extractorName = extractorName
+        this.cacheConfig = cacheConfig
+    }
+
+    /**
+     * Restores any artifacts that were cached separately, based on the information in the `cache-metadata.json` file.
+     * Each extracted cache entry is restored in parallel, except when debugging is enabled.
+     */
+    async restore(listener: CacheListener): Promise<void> {
+        const previouslyExtractedCacheEntries = this.loadExtractedCacheEntries()
+
+        const processes: Promise<ExtractedCacheEntry>[] = []
+
+        for (const cacheEntry of previouslyExtractedCacheEntries) {
+            const artifactType = cacheEntry.artifactType
+            const entryListener = listener.entry(cacheEntry.pattern)
+
+            // Handle case where the extracted-cache-entry definitions have been changed
+            const skipRestore = process.env[SKIP_RESTORE_VAR] || ''
+            if (skipRestore.includes(artifactType)) {
+                core.info(`Not restoring extracted cache entry for ${artifactType}`)
+                entryListener.markRequested('SKIP_RESTORE')
+            } else {
+                processes.push(
+                    this.awaitForDebugging(
+                        this.restoreExtractedCacheEntry(
+                            artifactType,
+                            cacheEntry.cacheKey!,
+                            cacheEntry.pattern,
+                            entryListener
+                        )
+                    )
+                )
+            }
+        }
+
+        this.saveMetadataForCacheResults(await Promise.all(processes))
+    }
+
+    private async restoreExtractedCacheEntry(
+        artifactType: string,
+        cacheKey: string,
+        pattern: string,
+        listener: CacheEntryListener
+    ): Promise<ExtractedCacheEntry> {
+        const restoredEntry = await restoreCache(pattern.split('\n'), cacheKey, [], listener)
+        if (restoredEntry) {
+            return new ExtractedCacheEntry(artifactType, pattern, cacheKey)
+        } else {
+            core.info(`Did not restore ${artifactType} with key ${cacheKey} to ${pattern}`)
+            return new ExtractedCacheEntry(artifactType, pattern, undefined)
+        }
+    }
+
+    /**
+     * Saves any artifacts that are configured to be cached separately, based on the extracted cache entry definitions.
+     * Each entry is extracted and saved in parallel, except when debugging is enabled.
+     */
+    async extract(listener: CacheListener): Promise<void> {
+        // Load the cache entry definitions (from config) and the previously restored entries (from persisted metadata file)
+        const cacheEntryDefinitions = this.getExtractedCacheEntryDefinitions()
+        cacheDebug(
+            `Extracting cache entries for ${this.extractorName}: ${JSON.stringify(cacheEntryDefinitions, null, 2)}`
+        )
+
+        const previouslyRestoredEntries = this.loadExtractedCacheEntries()
+        const cacheActions: Promise<ExtractedCacheEntry>[] = []
+
+        // For each cache entry definition, determine if it has already been restored, and if not, extract it
+        for (const cacheEntryDefinition of cacheEntryDefinitions) {
+            const artifactType = cacheEntryDefinition.artifactType
+            const pattern = cacheEntryDefinition.pattern
+
+            if (cacheEntryDefinition.notCacheableReason) {
+                listener.entry(pattern).markNotSaved(cacheEntryDefinition.notCacheableReason)
+                continue
+            }
+
+            // Find all matching files for this cache entry definition
+            const globber = await glob.create(pattern, {
+                implicitDescendants: false
+            })
+            const matchingFiles = await globber.glob()
+
+            if (matchingFiles.length === 0) {
+                cacheDebug(`No files found to cache for ${artifactType}`)
+                continue
+            }
+
+            if (cacheEntryDefinition.bundle) {
+                // For an extracted "bundle", use the defined pattern and cache all matching files in a single entry.
+                cacheActions.push(
+                    this.awaitForDebugging(
+                        this.saveExtractedCacheEntry(
+                            matchingFiles,
+                            artifactType,
+                            pattern,
+                            cacheEntryDefinition.uniqueFileNames,
+                            previouslyRestoredEntries,
+                            listener.entry(pattern)
+                        )
+                    )
+                )
+            } else {
+                // Otherwise cache each matching file in a separate entry, using the complete file path as the cache pattern.
+                for (const cacheFile of matchingFiles) {
+                    cacheActions.push(
+                        this.awaitForDebugging(
+                            this.saveExtractedCacheEntry(
+                                [cacheFile],
+                                artifactType,
+                                cacheFile,
+                                cacheEntryDefinition.uniqueFileNames,
+                                previouslyRestoredEntries,
+                                listener.entry(cacheFile)
+                            )
+                        )
+                    )
+                }
+            }
+        }
+
+        this.saveMetadataForCacheResults(await Promise.all(cacheActions))
+    }
+
+    private async saveExtractedCacheEntry(
+        matchingFiles: string[],
+        artifactType: string,
+        pattern: string,
+        uniqueFileNames: boolean,
+        previouslyRestoredEntries: ExtractedCacheEntry[],
+        entryListener: CacheEntryListener
+    ): Promise<ExtractedCacheEntry> {
+        const cacheKey = uniqueFileNames
+            ? this.createCacheKeyFromFileNames(artifactType, matchingFiles)
+            : await this.createCacheKeyFromFileContents(artifactType, pattern)
+        const previouslyRestoredKey = previouslyRestoredEntries.find(
+            x => x.artifactType === artifactType && x.pattern === pattern
+        )?.cacheKey
+
+        if (previouslyRestoredKey === cacheKey) {
+            cacheDebug(`No change to previously restored ${artifactType}. Not saving.`)
+            entryListener.markNotSaved('contents unchanged')
+        } else {
+            await saveCache(pattern.split('\n'), cacheKey, entryListener)
+        }
+
+        for (const file of matchingFiles) {
+            tryDelete(file)
+        }
+
+        return new ExtractedCacheEntry(artifactType, pattern, cacheKey)
+    }
+
+    protected createCacheKeyFromFileNames(artifactType: string, files: string[]): string {
+        const relativeFiles = files.map(x => path.relative(this.gradleUserHome, x))
+        const key = hashFileNames(relativeFiles)
+
+        cacheDebug(`Generating cache key for ${artifactType} from file names: ${relativeFiles}`)
+
+        return `${getCacheKeyBase(artifactType, CACHE_PROTOCOL_VERSION)}-${key}`
+    }
+
+    protected async createCacheKeyFromFileContents(artifactType: string, pattern: string): Promise<string> {
+        const key = await glob.hashFiles(pattern)
+
+        cacheDebug(`Generating cache key for ${artifactType} from files matching: ${pattern}`)
+
+        return `${getCacheKeyBase(artifactType, CACHE_PROTOCOL_VERSION)}-${key}`
+    }
+
+    // Run actions sequentially if debugging is enabled
+    private async awaitForDebugging(p: Promise<ExtractedCacheEntry>): Promise<ExtractedCacheEntry> {
+        if (isCacheDebuggingEnabled()) {
+            await p
+        }
+        return p
+    }
+
+    /**
+     * Load information about the extracted cache entries previously restored/saved. This is loaded from the 'cache-metadata.json' file.
+     */
+    protected loadExtractedCacheEntries(): ExtractedCacheEntry[] {
+        const cacheMetadataFile = this.getCacheMetadataFile()
+        if (!fs.existsSync(cacheMetadataFile)) {
+            return []
+        }
+
+        const filedata = fs.readFileSync(cacheMetadataFile, 'utf-8')
+        cacheDebug(`Loaded cache metadata for ${this.extractorName}: ${filedata}`)
+        const extractedCacheEntryMetadata = JSON.parse(filedata) as ExtractedCacheEntryMetadata
+        return extractedCacheEntryMetadata.entries
+    }
+
+    /**
+     * Saves information about the extracted cache entries into the 'cache-metadata.json' file.
+     */
+    protected saveMetadataForCacheResults(results: ExtractedCacheEntry[]): void {
+        const extractedCacheEntryMetadata = new ExtractedCacheEntryMetadata()
+        extractedCacheEntryMetadata.entries = results.filter(x => x.cacheKey !== undefined)
+
+        const filedata = JSON.stringify(extractedCacheEntryMetadata)
+        cacheDebug(`Saving cache metadata for ${this.extractorName}: ${filedata}`)
+
+        fs.writeFileSync(this.getCacheMetadataFile(), filedata, 'utf-8')
+    }
+
+    private getCacheMetadataFile(): string {
+        const actionMetadataDirectory = path.resolve(this.gradleUserHome, ACTION_METADATA_DIR)
+        fs.mkdirSync(actionMetadataDirectory, {recursive: true})
+
+        return path.resolve(actionMetadataDirectory, `${this.extractorName}-entry-metadata.json`)
+    }
+
+    protected abstract getExtractedCacheEntryDefinitions(): ExtractedCacheEntryDefinition[]
+}
+
+export class GradleHomeEntryExtractor extends AbstractEntryExtractor {
+    constructor(gradleUserHome: string, cacheConfig: CacheConfig) {
+        super(gradleUserHome, 'gradle-home', cacheConfig)
+    }
+
+    async extract(listener: CacheListener): Promise<void> {
+        await this.deleteWrapperZips()
+        return super.extract(listener)
+    }
+
+    /**
+     * Delete any downloaded wrapper zip files that are not needed after extraction.
+     * These files are cleaned up by Gradle >= 7.5, but for older versions we remove them manually.
+     */
+    private async deleteWrapperZips(): Promise<void> {
+        const wrapperZips = path.resolve(this.gradleUserHome, 'wrapper/dists/*/*/*.zip')
+        const globber = await glob.create(wrapperZips, {
+            implicitDescendants: false
+        })
+
+        for (const wrapperZip of await globber.glob()) {
+            cacheDebug(`Deleting wrapper zip: ${wrapperZip}`)
+            await tryDelete(wrapperZip)
+        }
+    }
+
+    /**
+     * Return the extracted cache entry definitions, which determine which artifacts will be cached
+     * separately from the rest of the Gradle User Home cache entry.
+     */
+    protected getExtractedCacheEntryDefinitions(): ExtractedCacheEntryDefinition[] {
+        const entryDefinition = (
+            artifactType: string,
+            patterns: string[],
+            bundle: boolean
+        ): ExtractedCacheEntryDefinition => {
+            const resolvedPatterns = patterns
+                .map(x => {
+                    const isDir = x.endsWith('/')
+                    const resolved = path.resolve(this.gradleUserHome, x)
+                    return isDir ? `${resolved}/` : resolved // Restore trailing '/' removed by path.resolve()
+                })
+                .join('\n')
+            return new ExtractedCacheEntryDefinition(artifactType, resolvedPatterns, bundle)
+        }
+
+        return [
+            entryDefinition('generated-gradle-jars', ['caches/*/generated-gradle-jars/*.jar'], false),
+            entryDefinition('wrapper-zips', ['wrapper/dists/*/*/'], false), // Each wrapper directory cached separately
+            entryDefinition('java-toolchains', ['jdks/*/'], false), // Each extracted JDK cached separately
+            entryDefinition('dependencies', ['caches/modules-*/files-*/*/*/*/*'], true),
+            entryDefinition('instrumented-jars', ['caches/jars-*/*/'], true),
+            entryDefinition('kotlin-dsl', ['caches/*/kotlin-dsl/accessors/*/', 'caches/*/kotlin-dsl/scripts/*/'], true),
+            entryDefinition('groovy-dsl', ['caches/*/groovy-dsl/*/'], true),
+            entryDefinition('transforms', ['caches/transforms-4/*/', 'caches/*/transforms/*/'], true)
+        ]
+    }
+}
+
+export class ConfigurationCacheEntryExtractor extends AbstractEntryExtractor {
+    constructor(gradleUserHome: string, cacheConfig: CacheConfig) {
+        super(gradleUserHome, 'configuration-cache', cacheConfig)
+    }
+
+    /**
+     * Handle the case where Gradle User Home has not been fully restored, so that the configuration-cache
+     * entry is not reusable.
+     */
+    async restore(listener: CacheListener): Promise<void> {
+        if (!listener.fullyRestored) {
+            this.markNotRestored(listener, 'Gradle User Home was not fully restored')
+            return
+        }
+
+        if (!this.cacheConfig.getCacheEncryptionKey()) {
+            this.markNotRestored(listener, 'Encryption Key was not provided')
+            return
+        }
+
+        return await super.restore(listener)
+    }
+
+    private markNotRestored(listener: CacheListener, reason: string): void {
+        const cacheEntries = this.loadExtractedCacheEntries()
+        if (cacheEntries.length > 0) {
+            core.info(`Not restoring configuration-cache state, as ${reason}`)
+            for (const cacheEntry of cacheEntries) {
+                listener.entry(cacheEntry.pattern).markNotRestored(reason)
+            }
+
+            // Update the results file based on no entries restored
+            this.saveMetadataForCacheResults([])
+        }
+    }
+
+    async extract(listener: CacheListener): Promise<void> {
+        if (!this.cacheConfig.getCacheEncryptionKey()) {
+            const cacheEntryDefinitions = this.getExtractedCacheEntryDefinitions()
+            if (cacheEntryDefinitions.length > 0) {
+                core.info('Not saving configuration-cache state, as no encryption key was provided')
+                for (const cacheEntry of cacheEntryDefinitions) {
+                    listener.entry(cacheEntry.pattern).markNotSaved('No encryption key provided')
+                }
+            }
+            return
+        }
+
+        await super.extract(listener)
+    }
+
+    /**
+     * Extract cache entries for the configuration cache in each project.
+     */
+    protected getExtractedCacheEntryDefinitions(): ExtractedCacheEntryDefinition[] {
+        // Group BuildResult by existing configCacheDir
+        const groupedResults = this.getConfigCacheDirectoriesWithAssociatedBuildResults()
+
+        return Object.entries(groupedResults).map(([configCachePath, pathResults]) => {
+            // Create a entry definition for each unique configuration cache directory
+            const definition = new ExtractedCacheEntryDefinition(
+                'configuration-cache',
+                configCachePath,
+                true
+            ).withNonUniqueFileNames()
+
+            // If any associated build result used Gradle < 8.6, then mark it as not cacheable
+            if (
+                pathResults.find(result => {
+                    return !versionIsAtLeast(result.gradleVersion, '8.6.0')
+                })
+            ) {
+                core.info(
+                    `Not saving config-cache data for ${configCachePath}. Configuration cache data is only saved for Gradle 8.6+`
+                )
+                definition.notCacheableBecause('Configuration cache data only saved for Gradle 8.6+')
+            }
+            return definition
+        })
+    }
+
+    private getConfigCacheDirectoriesWithAssociatedBuildResults(): Record<string, BuildResult[]> {
+        return loadBuildResults().results.reduce(
+            (acc, buildResult) => {
+                // For each build result, find the config-cache dir
+                const configCachePath = path.resolve(buildResult.rootProjectDir, '.gradle/configuration-cache')
+                // Ignore case where config-cache dir doesn't exist
+                if (!fs.existsSync(configCachePath)) {
+                    return acc
+                }
+
+                // Group by unique config cache directories and collect associated build results
+                if (!acc[configCachePath]) {
+                    acc[configCachePath] = []
+                }
+                acc[configCachePath].push(buildResult)
+                return acc
+            },
+            {} as Record<string, BuildResult[]>
+        )
+    }
+}

sources/src/caching/gradle-user-home-cache.ts

@@ -0,0 +1,290 @@
+import * as core from '@actions/core'
+import * as exec from '@actions/exec'
+import * as glob from '@actions/glob'
+
+import path from 'path'
+import fs from 'fs'
+import {generateCacheKey} from './cache-key'
+import {CacheListener} from './cache-reporting'
+import {saveCache, restoreCache, cacheDebug, isCacheDebuggingEnabled, tryDelete} from './cache-utils'
+import {CacheConfig, ACTION_METADATA_DIR} from '../configuration'
+import {GradleHomeEntryExtractor, ConfigurationCacheEntryExtractor} from './gradle-home-extry-extractor'
+import {getPredefinedToolchains, mergeToolchainContent, readResourceFileAsString} from './gradle-user-home-utils'
+
+const RESTORED_CACHE_KEY_KEY = 'restored-cache-key'
+
+export class GradleUserHomeCache {
+    private readonly cacheName = 'home'
+    private readonly cacheDescription = 'Gradle User Home'
+
+    private readonly userHome: string
+    private readonly gradleUserHome: string
+    private readonly cacheConfig: CacheConfig
+
+    constructor(userHome: string, gradleUserHome: string, cacheConfig: CacheConfig) {
+        this.userHome = userHome
+        this.gradleUserHome = gradleUserHome
+        this.cacheConfig = cacheConfig
+    }
+
+    init(): void {
+        this.initializeGradleUserHome()
+
+        // Export the GRADLE_ENCRYPTION_KEY variable if provided
+        const encryptionKey = this.cacheConfig.getCacheEncryptionKey()
+        if (encryptionKey) {
+            core.exportVariable('GRADLE_ENCRYPTION_KEY', encryptionKey)
+        }
+    }
+
+    cacheOutputExists(): boolean {
+        const cachesDir = path.resolve(this.gradleUserHome, 'caches')
+        if (fs.existsSync(cachesDir)) {
+            cacheDebug(`Cache output exists at ${cachesDir}`)
+            return true
+        }
+        return false
+    }
+
+    /**
+     * Restores the cache entry, finding the closest match to the currently running job.
+     */
+    async restore(listener: CacheListener): Promise<void> {
+        const entryListener = listener.entry(this.cacheDescription)
+
+        const cacheKey = generateCacheKey(this.cacheName, this.cacheConfig)
+
+        cacheDebug(
+            `Requesting ${this.cacheDescription} with
+    key:${cacheKey.key}
+    restoreKeys:[${cacheKey.restoreKeys}]`
+        )
+
+        const cachePath = this.getCachePath()
+        const cacheResult = await restoreCache(cachePath, cacheKey.key, cacheKey.restoreKeys, entryListener)
+        if (!cacheResult) {
+            core.info(`${this.cacheDescription} cache not found. Will initialize empty.`)
+            return
+        }
+
+        core.saveState(RESTORED_CACHE_KEY_KEY, cacheResult.key)
+
+        try {
+            await this.afterRestore(listener)
+        } catch (error) {
+            core.warning(`Restore ${this.cacheDescription} failed in 'afterRestore': ${error}`)
+        }
+    }
+
+    /**
+     * Restore any extracted cache entries after the main Gradle User Home entry is restored.
+     */
+    async afterRestore(listener: CacheListener): Promise<void> {
+        await this.debugReportGradleUserHomeSize('as restored from cache')
+        await new GradleHomeEntryExtractor(this.gradleUserHome, this.cacheConfig).restore(listener)
+        await new ConfigurationCacheEntryExtractor(this.gradleUserHome, this.cacheConfig).restore(listener)
+        await this.deleteExcludedPaths()
+        await this.debugReportGradleUserHomeSize('after restoring common artifacts')
+    }
+
+    /**
+     * Saves the cache entry based on the current cache key unless the cache was restored with the exact key,
+     * in which case we cannot overwrite it.
+     *
+     * If the cache entry was restored with a partial match on a restore key, then
+     * it is saved with the exact key.
+     */
+    async save(listener: CacheListener): Promise<void> {
+        const cacheKey = generateCacheKey(this.cacheName, this.cacheConfig).key
+        const restoredCacheKey = core.getState(RESTORED_CACHE_KEY_KEY)
+        const gradleHomeEntryListener = listener.entry(this.cacheDescription)
+
+        if (restoredCacheKey && cacheKey === restoredCacheKey) {
+            core.info(`Cache hit occurred on the cache key ${cacheKey}, not saving cache.`)
+
+            for (const entryListener of listener.cacheEntries) {
+                if (entryListener === gradleHomeEntryListener) {
+                    entryListener.markNotSaved('cache key not changed')
+                } else {
+                    entryListener.markNotSaved(`referencing '${this.cacheDescription}' cache entry not saved`)
+                }
+            }
+            return
+        }
+
+        try {
+            await this.beforeSave(listener)
+        } catch (error) {
+            core.warning(`Save ${this.cacheDescription} failed in 'beforeSave': ${error}`)
+            return
+        }
+
+        const cachePath = this.getCachePath()
+        await saveCache(cachePath, cacheKey, gradleHomeEntryListener)
+        return
+    }
+
+    /**
+     * Extract and save any defined extracted cache entries prior to the main Gradle User Home entry being saved.
+     */
+    async beforeSave(listener: CacheListener): Promise<void> {
+        await this.debugReportGradleUserHomeSize('before saving common artifacts')
+        await this.deleteExcludedPaths()
+        await Promise.all([
+            new GradleHomeEntryExtractor(this.gradleUserHome, this.cacheConfig).extract(listener),
+            new ConfigurationCacheEntryExtractor(this.gradleUserHome, this.cacheConfig).extract(listener)
+        ])
+        await this.debugReportGradleUserHomeSize(
+            "after extracting common artifacts (only 'caches' and 'notifications' will be stored)"
+        )
+    }
+
+    /**
+     * Delete any file paths that are excluded by the `gradle-home-cache-excludes` parameter.
+     */
+    private async deleteExcludedPaths(): Promise<void> {
+        const rawPaths: string[] = this.cacheConfig.getCacheExcludes()
+        rawPaths.push('caches/*/cc-keystore')
+        const resolvedPaths = rawPaths.map(x => path.resolve(this.gradleUserHome, x))
+
+        for (const p of resolvedPaths) {
+            cacheDebug(`Removing excluded path: ${p}`)
+            const globber = await glob.create(p, {
+                implicitDescendants: false
+            })
+
+            for (const toDelete of await globber.glob()) {
+                cacheDebug(`Removing excluded file: ${toDelete}`)
+                await tryDelete(toDelete)
+            }
+        }
+    }
+
+    /**
+     * Determines the paths within Gradle User Home to cache.
+     * By default, this is the 'caches' and 'notifications' directories,
+     * but this can be overridden by the `gradle-home-cache-includes` parameter.
+     */
+    protected getCachePath(): string[] {
+        const rawPaths: string[] = this.cacheConfig.getCacheIncludes()
+        rawPaths.push(ACTION_METADATA_DIR)
+        const resolvedPaths = rawPaths.map(x => this.resolveCachePath(x))
+        cacheDebug(`Using cache paths: ${resolvedPaths}`)
+        return resolvedPaths
+    }
+
+    private resolveCachePath(rawPath: string): string {
+        if (rawPath.startsWith('!')) {
+            const resolved = this.resolveCachePath(rawPath.substring(1))
+            return `!${resolved}`
+        }
+        return path.resolve(this.gradleUserHome, rawPath)
+    }
+
+    private initializeGradleUserHome(): void {
+        // Create a directory for storing action metadata
+        const actionCacheDir = path.resolve(this.gradleUserHome, ACTION_METADATA_DIR)
+        fs.mkdirSync(actionCacheDir, {recursive: true})
+
+        this.copyInitScripts()
+
+        // Copy the default toolchain definitions to `~/.m2/toolchains.xml`
+        this.registerToolchains()
+
+        if (core.isDebug()) {
+            this.configureInfoLogLevel()
+        }
+    }
+
+    private copyInitScripts(): void {
+        // Copy init scripts from src/resources to Gradle UserHome
+        const initScriptsDir = path.resolve(this.gradleUserHome, 'init.d')
+        fs.mkdirSync(initScriptsDir, {recursive: true})
+        const initScriptFilenames = [
+            'gradle-actions.build-result-capture.init.gradle',
+            'gradle-actions.build-result-capture-service.plugin.groovy',
+            'gradle-actions.github-dependency-graph.init.gradle',
+            'gradle-actions.github-dependency-graph-gradle-plugin-apply.groovy',
+            'gradle-actions.inject-develocity.init.gradle'
+        ]
+        for (const initScriptFilename of initScriptFilenames) {
+            const initScriptContent = readResourceFileAsString('init-scripts', initScriptFilename)
+            const initScriptPath = path.resolve(initScriptsDir, initScriptFilename)
+            fs.writeFileSync(initScriptPath, initScriptContent)
+        }
+    }
+
+    private registerToolchains(): void {
+        const preInstalledToolchains: string | null = getPredefinedToolchains()
+        if (preInstalledToolchains == null) return
+
+        const m2dir = path.resolve(this.userHome, '.m2')
+        const toolchainXmlTarget = path.resolve(m2dir, 'toolchains.xml')
+        if (!fs.existsSync(toolchainXmlTarget)) {
+            // Write a new toolchains.xml file if it doesn't exist
+            fs.mkdirSync(m2dir, {recursive: true})
+            fs.writeFileSync(toolchainXmlTarget, preInstalledToolchains)
+
+            core.info(`Wrote default JDK locations to ${toolchainXmlTarget}`)
+        } else {
+            // Merge into an existing toolchains.xml file
+            const existingToolchainContent = fs.readFileSync(toolchainXmlTarget, 'utf8')
+            const mergedContent = mergeToolchainContent(existingToolchainContent, preInstalledToolchains)
+
+            fs.writeFileSync(toolchainXmlTarget, mergedContent)
+            core.info(`Merged default JDK locations into ${toolchainXmlTarget}`)
+        }
+    }
+
+    /**
+     * When the GitHub environment ACTIONS_RUNNER_DEBUG is true, run Gradle with --info and --stacktrace.
+     * see https://docs.github.com/en/actions/monitoring-and-troubleshooting-workflows/enabling-debug-logging
+     *
+     * @VisibleForTesting
+     */
+    configureInfoLogLevel(): void {
+        const infoProperties = `org.gradle.logging.level=info\norg.gradle.logging.stacktrace=all\n`
+        const propertiesFile = path.resolve(this.gradleUserHome, 'gradle.properties')
+        if (fs.existsSync(propertiesFile)) {
+            core.info(`Merged --info and --stacktrace into existing ${propertiesFile} file`)
+            const existingProperties = fs.readFileSync(propertiesFile, 'utf-8')
+            fs.writeFileSync(propertiesFile, `${infoProperties}\n${existingProperties}`)
+        } else {
+            core.info(`Created a new ${propertiesFile} with --info and --stacktrace`)
+            fs.writeFileSync(propertiesFile, infoProperties)
+        }
+    }
+
+    /**
+     * When cache debugging is enabled (or ACTIONS_STEP_DEBUG is on),
+     * this method will give a detailed report of the Gradle User Home contents.
+     */
+    private async debugReportGradleUserHomeSize(label: string): Promise<void> {
+        if (!isCacheDebuggingEnabled() && !core.isDebug()) {
+            return
+        }
+        if (!fs.existsSync(this.gradleUserHome)) {
+            return
+        }
+        const result = await exec.getExecOutput('du', ['-h', '-c', '-t', '5M'], {
+            cwd: this.gradleUserHome,
+            silent: true,
+            ignoreReturnCode: true
+        })
+
+        core.info(`Gradle User Home (directories >5M): ${label}`)
+
+        core.info(
+            result.stdout
+                .trimEnd()
+                .replace(/\t/g, '    ')
+                .split('\n')
+                .map(it => {
+                    return `  ${it}`
+                })
+                .join('\n')
+        )
+
+        core.info('-----------------------')
+    }
+}

sources/src/caching/gradle-user-home-utils.ts

@@ -0,0 +1,49 @@
+import path from 'path'
+import fs from 'fs'
+
+export function readResourceFileAsString(...paths: string[]): string {
+    // Resolving relative to __dirname will allow node to find the resource at runtime
+    const absolutePath = path.resolve(__dirname, '..', '..', '..', 'sources', 'src', 'resources', ...paths)
+    return fs.readFileSync(absolutePath, 'utf8')
+}
+
+/**
+ * Iterate over all `JAVA_HOME_{version}_{arch}` envs and construct the toolchain.xml.
+ *
+ * @VisibleForTesting
+ */
+export function getPredefinedToolchains(): string | null {
+    const javaHomeEnvs: string[] = []
+    for (const javaHomeEnvsKey in process.env) {
+        if (javaHomeEnvsKey.startsWith('JAVA_HOME_')) {
+            javaHomeEnvs.push(javaHomeEnvsKey)
+        }
+    }
+    if (javaHomeEnvs.length === 0) {
+        return null
+    }
+    // language=XML
+    let toolchainsXml = `<?xml version="1.0" encoding="UTF-8"?>
+<toolchains>
+<!-- JDK Toolchains installed by default on GitHub-hosted runners -->
+`
+    for (const javaHomeEnv of javaHomeEnvs) {
+        const version = javaHomeEnv.match(/JAVA_HOME_(\d+)_/)?.[1]!
+        toolchainsXml += `  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>${version}</version>
+    </provides>
+    <configuration>
+      <jdkHome>\${env.${javaHomeEnv}}</jdkHome>
+    </configuration>
+  </toolchain>\n`
+    }
+    toolchainsXml += `</toolchains>\n`
+    return toolchainsXml
+}
+
+export function mergeToolchainContent(existingToolchainContent: string, preInstalledToolchains: string): string {
+    const appendedContent = preInstalledToolchains.split('<toolchains>').pop()!
+    return existingToolchainContent.replace('</toolchains>', appendedContent)
+}

sources/src/configuration.ts

@@ -0,0 +1,431 @@
+import * as core from '@actions/core'
+import * as github from '@actions/github'
+import * as cache from '@actions/cache'
+import * as deprecator from './deprecation-collector'
+import {SUMMARY_ENV_VAR} from '@actions/core/lib/summary'
+
+import path from 'path'
+
+const ACTION_ID_VAR = 'GRADLE_ACTION_ID'
+
+export const ACTION_METADATA_DIR = '.setup-gradle'
+
+export class DependencyGraphConfig {
+    getDependencyGraphOption(): DependencyGraphOption {
+        const val = core.getInput('dependency-graph')
+        switch (val.toLowerCase().trim()) {
+            case 'disabled':
+                return DependencyGraphOption.Disabled
+            case 'generate':
+                return DependencyGraphOption.Generate
+            case 'generate-and-submit':
+                return DependencyGraphOption.GenerateAndSubmit
+            case 'generate-and-upload':
+                return DependencyGraphOption.GenerateAndUpload
+            case 'download-and-submit':
+                return DependencyGraphOption.DownloadAndSubmit
+        }
+        throw TypeError(
+            `The value '${val}' is not valid for 'dependency-graph'. Valid values are: [disabled, generate, generate-and-submit, generate-and-upload, download-and-submit]. The default value is 'disabled'.`
+        )
+    }
+
+    getDependencyGraphContinueOnFailure(): boolean {
+        return getBooleanInput('dependency-graph-continue-on-failure', true)
+    }
+
+    getArtifactRetentionDays(): number {
+        const val = core.getInput('artifact-retention-days')
+        return parseNumericInput('artifact-retention-days', val, 0)
+        // Zero indicates that the default repository settings should be used
+    }
+
+    getJobCorrelator(): string {
+        return DependencyGraphConfig.constructJobCorrelator(github.context.workflow, github.context.job, getJobMatrix())
+    }
+
+    getReportDirectory(): string {
+        const param = core.getInput('dependency-graph-report-dir')
+        return path.resolve(getWorkspaceDirectory(), param)
+    }
+
+    getDownloadArtifactName(): string | undefined {
+        return process.env['DEPENDENCY_GRAPH_DOWNLOAD_ARTIFACT_NAME']
+    }
+
+    getExcludeProjects(): string | undefined {
+        return getOptionalInput('dependency-graph-exclude-projects')
+    }
+
+    getIncludeProjects(): string | undefined {
+        return getOptionalInput('dependency-graph-include-projects')
+    }
+
+    getExcludeConfigurations(): string | undefined {
+        return getOptionalInput('dependency-graph-exclude-configurations')
+    }
+
+    getIncludeConfigurations(): string | undefined {
+        return getOptionalInput('dependency-graph-include-configurations')
+    }
+
+    static constructJobCorrelator(workflow: string, jobId: string, matrixJson: string): string {
+        const matrixString = this.describeMatrix(matrixJson)
+        const label = matrixString ? `${workflow}-${jobId}-${matrixString}` : `${workflow}-${jobId}`
+        return this.sanitize(label)
+    }
+
+    private static describeMatrix(matrixJson: string): string {
+        core.debug(`Got matrix json: ${matrixJson}`)
+        const matrix = JSON.parse(matrixJson)
+        if (matrix) {
+            return Object.values(matrix).join('-')
+        }
+        return ''
+    }
+
+    private static sanitize(value: string): string {
+        return value
+            .replace(/[^a-zA-Z0-9_-\s]/g, '')
+            .replace(/\s+/g, '_')
+            .toLowerCase()
+    }
+}
+
+export enum DependencyGraphOption {
+    Disabled = 'disabled',
+    Generate = 'generate',
+    GenerateAndSubmit = 'generate-and-submit',
+    GenerateAndUpload = 'generate-and-upload',
+    DownloadAndSubmit = 'download-and-submit'
+}
+
+export class CacheConfig {
+    isCacheDisabled(): boolean {
+        if (!cache.isFeatureAvailable()) {
+            return true
+        }
+
+        return getBooleanInput('cache-disabled')
+    }
+
+    isCacheReadOnly(): boolean {
+        return !this.isCacheWriteOnly() && getBooleanInput('cache-read-only')
+    }
+
+    isCacheWriteOnly(): boolean {
+        return getBooleanInput('cache-write-only')
+    }
+
+    isCacheOverwriteExisting(): boolean {
+        return getBooleanInput('cache-overwrite-existing')
+    }
+
+    isCacheStrictMatch(): boolean {
+        return getBooleanInput('gradle-home-cache-strict-match')
+    }
+
+    isCacheCleanupEnabled(): boolean {
+        if (this.isCacheReadOnly()) {
+            return false
+        }
+        const cleanupOption = this.getCacheCleanupOption()
+        return cleanupOption === CacheCleanupOption.Always || cleanupOption === CacheCleanupOption.OnSuccess
+    }
+
+    shouldPerformCacheCleanup(hasFailure: boolean): boolean {
+        const cleanupOption = this.getCacheCleanupOption()
+        if (cleanupOption === CacheCleanupOption.Always) {
+            return true
+        }
+        if (cleanupOption === CacheCleanupOption.OnSuccess) {
+            return !hasFailure
+        }
+        return false
+    }
+
+    private getCacheCleanupOption(): CacheCleanupOption {
+        const legacyVal = getOptionalBooleanInput('gradle-home-cache-cleanup')
+        if (legacyVal !== undefined) {
+            deprecator.recordDeprecation(
+                'The `gradle-home-cache-cleanup` input parameter has been replaced by `cache-cleanup`'
+            )
+            return legacyVal ? CacheCleanupOption.Always : CacheCleanupOption.Never
+        }
+
+        const val = core.getInput('cache-cleanup')
+        switch (val.toLowerCase().trim()) {
+            case 'always':
+                return CacheCleanupOption.Always
+            case 'on-success':
+                return CacheCleanupOption.OnSuccess
+            case 'never':
+                return CacheCleanupOption.Never
+        }
+        throw TypeError(
+            `The value '${val}' is not valid for cache-cleanup. Valid values are: [never, always, on-success].`
+        )
+    }
+
+    getCacheEncryptionKey(): string {
+        return core.getInput('cache-encryption-key')
+    }
+
+    getCacheIncludes(): string[] {
+        return core.getMultilineInput('gradle-home-cache-includes')
+    }
+
+    getCacheExcludes(): string[] {
+        return core.getMultilineInput('gradle-home-cache-excludes')
+    }
+}
+
+export enum CacheCleanupOption {
+    Never = 'never',
+    OnSuccess = 'on-success',
+    Always = 'always'
+}
+
+export class SummaryConfig {
+    shouldGenerateJobSummary(hasFailure: boolean): boolean {
+        // Check if Job Summary is supported on this platform
+        if (!process.env[SUMMARY_ENV_VAR]) {
+            return false
+        }
+
+        return this.shouldAddJobSummary(this.getJobSummaryOption(), hasFailure)
+    }
+
+    shouldAddPRComment(hasFailure: boolean): boolean {
+        return this.shouldAddJobSummary(this.getPRCommentOption(), hasFailure)
+    }
+
+    private shouldAddJobSummary(option: JobSummaryOption, hasFailure: boolean): boolean {
+        switch (option) {
+            case JobSummaryOption.Always:
+                return true
+            case JobSummaryOption.Never:
+                return false
+            case JobSummaryOption.OnFailure:
+                return hasFailure
+        }
+    }
+
+    private getJobSummaryOption(): JobSummaryOption {
+        return this.parseJobSummaryOption('add-job-summary')
+    }
+
+    private getPRCommentOption(): JobSummaryOption {
+        return this.parseJobSummaryOption('add-job-summary-as-pr-comment')
+    }
+
+    private parseJobSummaryOption(paramName: string): JobSummaryOption {
+        const val = core.getInput(paramName)
+        switch (val.toLowerCase().trim()) {
+            case 'never':
+                return JobSummaryOption.Never
+            case 'always':
+                return JobSummaryOption.Always
+            case 'on-failure':
+                return JobSummaryOption.OnFailure
+        }
+        throw TypeError(
+            `The value '${val}' is not valid for ${paramName}. Valid values are: [never, always, on-failure].`
+        )
+    }
+}
+
+export enum JobSummaryOption {
+    Never = 'never',
+    Always = 'always',
+    OnFailure = 'on-failure'
+}
+
+export class BuildScanConfig {
+    static DevelocityAccessKeyEnvVar = 'DEVELOCITY_ACCESS_KEY'
+    static GradleEnterpriseAccessKeyEnvVar = 'GRADLE_ENTERPRISE_ACCESS_KEY'
+
+    getBuildScanPublishEnabled(): boolean {
+        return getBooleanInput('build-scan-publish') && this.verifyTermsOfUseAgreement()
+    }
+
+    getBuildScanTermsOfUseUrl(): string {
+        return core.getInput('build-scan-terms-of-use-url')
+    }
+
+    getBuildScanTermsOfUseAgree(): string {
+        return core.getInput('build-scan-terms-of-use-agree')
+    }
+
+    getDevelocityAccessKey(): string {
+        return (
+            core.getInput('develocity-access-key') ||
+            process.env[BuildScanConfig.DevelocityAccessKeyEnvVar] ||
+            process.env[BuildScanConfig.GradleEnterpriseAccessKeyEnvVar] ||
+            ''
+        )
+    }
+
+    getDevelocityTokenExpiry(): string {
+        return core.getInput('develocity-token-expiry')
+    }
+
+    getDevelocityInjectionEnabled(): boolean | undefined {
+        return getOptionalBooleanInput('develocity-injection-enabled')
+    }
+
+    getDevelocityUrl(): string {
+        return core.getInput('develocity-url')
+    }
+
+    getDevelocityAllowUntrustedServer(): boolean | undefined {
+        return getOptionalBooleanInput('develocity-allow-untrusted-server')
+    }
+
+    getDevelocityCaptureFileFingerprints(): boolean | undefined {
+        return getOptionalBooleanInput('develocity-capture-file-fingerprints')
+    }
+
+    getDevelocityEnforceUrl(): boolean | undefined {
+        return getOptionalBooleanInput('develocity-enforce-url')
+    }
+
+    getDevelocityPluginVersion(): string {
+        return core.getInput('develocity-plugin-version')
+    }
+
+    getDevelocityCcudPluginVersion(): string {
+        return core.getInput('develocity-ccud-plugin-version')
+    }
+
+    getGradlePluginRepositoryUrl(): string {
+        return core.getInput('gradle-plugin-repository-url')
+    }
+
+    getGradlePluginRepositoryUsername(): string {
+        return core.getInput('gradle-plugin-repository-username')
+    }
+
+    getGradlePluginRepositoryPassword(): string {
+        return core.getInput('gradle-plugin-repository-password')
+    }
+
+    private verifyTermsOfUseAgreement(): boolean {
+        if (
+            (this.getBuildScanTermsOfUseUrl() !== 'https://gradle.com/terms-of-service' &&
+                this.getBuildScanTermsOfUseUrl() !== 'https://gradle.com/help/legal-terms-of-use') ||
+            this.getBuildScanTermsOfUseAgree() !== 'yes'
+        ) {
+            core.warning(
+                `Terms of use at 'https://gradle.com/help/legal-terms-of-use' must be agreed in order to publish build scans.`
+            )
+            return false
+        }
+        return true
+    }
+}
+
+export class GradleExecutionConfig {
+    getGradleVersion(): string {
+        return core.getInput('gradle-version')
+    }
+
+    getBuildRootDirectory(): string {
+        const baseDirectory = getWorkspaceDirectory()
+        const buildRootDirectoryInput = core.getInput('build-root-directory')
+        const resolvedBuildRootDirectory =
+            buildRootDirectoryInput === ''
+                ? path.resolve(baseDirectory)
+                : path.resolve(baseDirectory, buildRootDirectoryInput)
+        return resolvedBuildRootDirectory
+    }
+
+    getDependencyResolutionTask(): string {
+        return core.getInput('dependency-resolution-task') || ':ForceDependencyResolutionPlugin_resolveAllDependencies'
+    }
+
+    getAdditionalArguments(): string {
+        return core.getInput('additional-arguments')
+    }
+
+    verifyNoArguments(): void {
+        const input = core.getInput('arguments')
+        if (input.length !== 0) {
+            deprecator.failOnUseOfRemovedFeature(
+                `The 'arguments' parameter is no longer supported for ${getActionId()}`,
+                'Using the action to execute Gradle via the `arguments` parameter is deprecated'
+            )
+        }
+    }
+}
+
+export class WrapperValidationConfig {
+    doValidateWrappers(): boolean {
+        return getBooleanInput('validate-wrappers')
+    }
+
+    allowSnapshotWrappers(): boolean {
+        return getBooleanInput('allow-snapshot-wrappers')
+    }
+}
+
+// Internal parameters
+export function getJobMatrix(): string {
+    return core.getInput('workflow-job-context')
+}
+
+export function getGithubToken(): string {
+    return core.getInput('github-token', {required: true})
+}
+
+export function getWorkspaceDirectory(): string {
+    return process.env[`GITHUB_WORKSPACE`] || ''
+}
+
+export function getActionId(): string | undefined {
+    return process.env[ACTION_ID_VAR]
+}
+
+export function setActionId(id: string): void {
+    core.exportVariable(ACTION_ID_VAR, id)
+}
+
+export function parseNumericInput(paramName: string, paramValue: string, paramDefault: number): number {
+    if (paramValue.length === 0) {
+        return paramDefault
+    }
+    const numericValue = parseInt(paramValue)
+    if (isNaN(numericValue)) {
+        throw TypeError(`The value '${paramValue}' is not a valid numeric value for '${paramName}'.`)
+    }
+    return numericValue
+}
+
+function getOptionalInput(paramName: string): string | undefined {
+    const paramValue = core.getInput(paramName)
+    if (paramValue.length > 0) {
+        return paramValue
+    }
+    return undefined
+}
+
+function getBooleanInput(paramName: string, paramDefault = false): boolean {
+    const paramValue = core.getInput(paramName)
+    switch (paramValue.toLowerCase().trim()) {
+        case '':
+            return paramDefault
+        case 'false':
+            return false
+        case 'true':
+            return true
+    }
+    throw TypeError(`The value '${paramValue} is not valid for '${paramName}. Valid values are: [true, false]`)
+}
+
+function getOptionalBooleanInput(paramName: string): boolean | undefined {
+    const paramValue = core.getInput(paramName)
+    if (paramValue === '') {
+        return undefined
+    }
+    return getBooleanInput(paramName)
+}

sources/src/daemon-controller.ts

@@ -0,0 +1,33 @@
+import * as core from '@actions/core'
+import * as exec from '@actions/exec'
+import * as fs from 'fs'
+import * as path from 'path'
+import {BuildResults} from './build-results'
+
+export class DaemonController {
+    private readonly gradleHomes
+
+    constructor(buildResults: BuildResults) {
+        this.gradleHomes = buildResults.uniqueGradleHomes()
+    }
+
+    async stopAllDaemons(): Promise<void> {
+        const executions: Promise<number>[] = []
+        const args = ['--stop']
+
+        for (const gradleHome of this.gradleHomes) {
+            const executable = path.resolve(gradleHome, 'bin', 'gradle')
+            if (!fs.existsSync(executable)) {
+                core.warning(`Gradle executable not found at ${executable}. Could not stop Gradle daemons.`)
+                continue
+            }
+            core.info(`Stopping Gradle daemons for ${gradleHome}`)
+            executions.push(
+                exec.exec(executable, args, {
+                    ignoreReturnCode: true
+                })
+            )
+        }
+        await Promise.all(executions)
+    }
+}

sources/src/dependency-graph.ts

@@ -0,0 +1,271 @@
+import * as core from '@actions/core'
+import * as github from '@actions/github'
+import * as glob from '@actions/glob'
+import {DefaultArtifactClient} from '@actions/artifact'
+import {GitHub} from '@actions/github/lib/utils'
+import {RequestError} from '@octokit/request-error'
+import type {PullRequestEvent} from '@octokit/webhooks-types'
+
+import * as path from 'path'
+import fs from 'fs'
+
+import {JobFailure} from './errors'
+import {DependencyGraphConfig, DependencyGraphOption, getGithubToken, getWorkspaceDirectory} from './configuration'
+
+const DEPENDENCY_GRAPH_PREFIX = 'dependency-graph_'
+
+export async function setup(config: DependencyGraphConfig): Promise<void> {
+    const option = config.getDependencyGraphOption()
+    if (option === DependencyGraphOption.Disabled) {
+        core.exportVariable('GITHUB_DEPENDENCY_GRAPH_ENABLED', 'false')
+        return
+    }
+    // Download and submit early, for compatability with dependency review.
+    if (option === DependencyGraphOption.DownloadAndSubmit) {
+        maybeExportVariable('DEPENDENCY_GRAPH_REPORT_DIR', config.getReportDirectory())
+        await downloadAndSubmitDependencyGraphs(config)
+        return
+    }
+
+    core.info('Enabling dependency graph generation')
+    core.exportVariable('GITHUB_DEPENDENCY_GRAPH_ENABLED', 'true')
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_CONTINUE_ON_FAILURE', config.getDependencyGraphContinueOnFailure())
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR', config.getJobCorrelator())
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_JOB_ID', github.context.runId.toString())
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_REF', github.context.ref)
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_SHA', getShaFromContext())
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_WORKSPACE', getWorkspaceDirectory())
+    maybeExportVariable('DEPENDENCY_GRAPH_REPORT_DIR', config.getReportDirectory())
+
+    maybeExportVariable('DEPENDENCY_GRAPH_EXCLUDE_PROJECTS', config.getExcludeProjects())
+    maybeExportVariable('DEPENDENCY_GRAPH_INCLUDE_PROJECTS', config.getIncludeProjects())
+    maybeExportVariable('DEPENDENCY_GRAPH_EXCLUDE_CONFIGURATIONS', config.getExcludeConfigurations())
+    maybeExportVariable('DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS', config.getIncludeConfigurations())
+}
+
+function maybeExportVariable(variableName: string, value: string | boolean | undefined): void {
+    if (!process.env[variableName]) {
+        if (value !== undefined) {
+            core.exportVariable(variableName, value)
+        }
+    }
+}
+
+export async function complete(config: DependencyGraphConfig): Promise<void> {
+    const option = config.getDependencyGraphOption()
+    try {
+        switch (option) {
+            case DependencyGraphOption.Disabled:
+            case DependencyGraphOption.Generate: // Performed via init-script: nothing to do here
+            case DependencyGraphOption.DownloadAndSubmit: // Performed in setup
+                return
+            case DependencyGraphOption.GenerateAndSubmit:
+                await findAndSubmitDependencyGraphs(config)
+                return
+            case DependencyGraphOption.GenerateAndUpload:
+                await findAndUploadDependencyGraphs(config)
+        }
+    } catch (e) {
+        warnOrFail(config, option, e)
+    }
+}
+
+async function downloadAndSubmitDependencyGraphs(config: DependencyGraphConfig): Promise<void> {
+    if (isRunningInActEnvironment()) {
+        core.info('Dependency graph not supported in the ACT environment.')
+        return
+    }
+
+    try {
+        await submitDependencyGraphs(await downloadDependencyGraphs(config))
+    } catch (e) {
+        warnOrFail(config, DependencyGraphOption.DownloadAndSubmit, e)
+    }
+}
+
+async function findAndSubmitDependencyGraphs(config: DependencyGraphConfig): Promise<void> {
+    if (isRunningInActEnvironment()) {
+        core.info('Dependency graph not supported in the ACT environment.')
+        return
+    }
+
+    const dependencyGraphFiles = await findDependencyGraphFiles()
+    try {
+        await submitDependencyGraphs(dependencyGraphFiles)
+    } catch (e) {
+        try {
+            await uploadDependencyGraphs(dependencyGraphFiles, config)
+        } catch (uploadError) {
+            core.info(String(uploadError))
+        }
+        throw e
+    }
+}
+
+async function findAndUploadDependencyGraphs(config: DependencyGraphConfig): Promise<void> {
+    if (isRunningInActEnvironment()) {
+        core.info('Dependency graph not supported in the ACT environment.')
+        return
+    }
+
+    await uploadDependencyGraphs(await findDependencyGraphFiles(), config)
+}
+
+async function downloadDependencyGraphs(config: DependencyGraphConfig): Promise<string[]> {
+    const findBy = github.context.payload.workflow_run
+        ? {
+              token: getGithubToken(),
+              workflowRunId: github.context.payload.workflow_run.id,
+              repositoryName: github.context.repo.repo,
+              repositoryOwner: github.context.repo.owner
+          }
+        : undefined
+
+    const artifactClient = new DefaultArtifactClient()
+
+    let dependencyGraphArtifacts = (
+        await artifactClient.listArtifacts({
+            latest: true,
+            findBy
+        })
+    ).artifacts.filter(artifact => artifact.name.startsWith(DEPENDENCY_GRAPH_PREFIX))
+
+    const artifactName = config.getDownloadArtifactName()
+    if (artifactName) {
+        core.info(`Filtering for artifacts ending with ${artifactName}`)
+        dependencyGraphArtifacts = dependencyGraphArtifacts.filter(artifact => artifact.name.includes(artifactName))
+    }
+
+    for (const artifact of dependencyGraphArtifacts) {
+        const downloadedArtifact = await artifactClient.downloadArtifact(artifact.id, {
+            findBy
+        })
+        core.info(`Downloading dependency-graph artifact ${artifact.name} to ${downloadedArtifact.downloadPath}`)
+    }
+
+    return findDependencyGraphFiles()
+}
+
+async function findDependencyGraphFiles(): Promise<string[]> {
+    const globber = await glob.create(`${getReportDirectory()}/**/*.json`)
+    const allFiles = await globber.glob()
+    const unprocessedFiles = allFiles.filter(file => !isProcessed(file))
+    unprocessedFiles.forEach(markProcessed)
+    core.info(`Found dependency graph files: ${unprocessedFiles.join(', ')}`)
+    return unprocessedFiles
+}
+
+async function uploadDependencyGraphs(dependencyGraphFiles: string[], config: DependencyGraphConfig): Promise<void> {
+    if (dependencyGraphFiles.length === 0) {
+        core.info('No dependency graph files found to upload.')
+        return
+    }
+
+    const workspaceDirectory = getWorkspaceDirectory()
+
+    const artifactClient = new DefaultArtifactClient()
+    for (const dependencyGraphFile of dependencyGraphFiles) {
+        const relativePath = getRelativePathFromWorkspace(dependencyGraphFile)
+        core.info(`Uploading dependency graph file: ${relativePath}`)
+        const artifactName = `${DEPENDENCY_GRAPH_PREFIX}${path.basename(dependencyGraphFile)}`
+        await artifactClient.uploadArtifact(artifactName, [dependencyGraphFile], workspaceDirectory, {
+            retentionDays: config.getArtifactRetentionDays()
+        })
+    }
+}
+
+async function submitDependencyGraphs(dependencyGraphFiles: string[]): Promise<void> {
+    if (dependencyGraphFiles.length === 0) {
+        core.info('No dependency graph files found to submit.')
+        return
+    }
+
+    for (const dependencyGraphFile of dependencyGraphFiles) {
+        try {
+            await submitDependencyGraphFile(dependencyGraphFile)
+        } catch (error) {
+            if (error instanceof RequestError) {
+                error.message = translateErrorMessage(dependencyGraphFile, error)
+            }
+            throw error
+        }
+    }
+}
+
+function translateErrorMessage(jsonFile: string, error: RequestError): string {
+    const relativeJsonFile = getRelativePathFromWorkspace(jsonFile)
+    const mainWarning = `Dependency submission failed for ${relativeJsonFile}.\n${error.message}`
+    if (error.message === 'Resource not accessible by integration') {
+        return `${mainWarning}
+Please ensure that the 'contents: write' permission is available for the workflow job.
+Note that this permission is never available for a 'pull_request' trigger from a repository fork.
+        `
+    }
+    return mainWarning
+}
+
+async function submitDependencyGraphFile(jsonFile: string): Promise<void> {
+    const octokit = getOctokit()
+    const jsonContent = fs.readFileSync(jsonFile, 'utf8')
+
+    const jsonObject = JSON.parse(jsonContent)
+    jsonObject.owner = github.context.repo.owner
+    jsonObject.repo = github.context.repo.repo
+    const response = await octokit.request('POST /repos/{owner}/{repo}/dependency-graph/snapshots', jsonObject)
+
+    const relativeJsonFile = getRelativePathFromWorkspace(jsonFile)
+    core.notice(`Submitted ${relativeJsonFile}: ${response.data.message}`)
+}
+function getReportDirectory(): string {
+    return process.env.DEPENDENCY_GRAPH_REPORT_DIR!
+}
+
+function isProcessed(dependencyGraphFile: string): boolean {
+    const markerFile = `${dependencyGraphFile}.processed`
+    return fs.existsSync(markerFile)
+}
+
+function markProcessed(dependencyGraphFile: string): void {
+    const markerFile = `${dependencyGraphFile}.processed`
+    fs.writeFileSync(markerFile, '')
+}
+
+function warnOrFail(config: DependencyGraphConfig, option: String, error: unknown): void {
+    if (!config.getDependencyGraphContinueOnFailure()) {
+        throw new JobFailure(error)
+    }
+
+    core.warning(`Failed to ${option} dependency graph. Will continue.\n${String(error)}`)
+}
+
+function getOctokit(): InstanceType<typeof GitHub> {
+    return github.getOctokit(getGithubToken())
+}
+
+function getRelativePathFromWorkspace(file: string): string {
+    const workspaceDirectory = getWorkspaceDirectory()
+    return path.relative(workspaceDirectory, file)
+}
+
+function getShaFromContext(): string {
+    const context = github.context
+    const pullRequestEvents = [
+        'pull_request',
+        'pull_request_comment',
+        'pull_request_review',
+        'pull_request_review_comment'
+        // Note that pull_request_target is omitted here.
+        // That event runs in the context of the base commit of the PR,
+        // so the snapshot should not be associated with the head commit.
+    ]
+    if (pullRequestEvents.includes(context.eventName)) {
+        const pr = (context.payload as PullRequestEvent).pull_request
+        return pr.head.sha
+    } else {
+        return context.sha
+    }
+}
+
+function isRunningInActEnvironment(): boolean {
+    return process.env.ACT !== undefined
+}

sources/src/deprecation-collector.ts

@@ -0,0 +1,70 @@
+import * as core from '@actions/core'
+import {getActionId} from './configuration'
+
+const DEPRECATION_UPGRADE_PAGE = 'https://github.com/gradle/actions/blob/main/docs/deprecation-upgrade-guide.md'
+const recordedDeprecations: Deprecation[] = []
+const recordedErrors: string[] = []
+
+export class Deprecation {
+    constructor(readonly message: string) {}
+
+    getDocumentationLink(): string {
+        const deprecationAnchor = this.message
+            .toLowerCase()
+            .replace(/[^\w\s-]|_/g, '')
+            .replace(/ /g, '-')
+        return `${DEPRECATION_UPGRADE_PAGE}#${deprecationAnchor}`
+    }
+}
+
+export function recordDeprecation(message: string): void {
+    if (!recordedDeprecations.some(deprecation => deprecation.message === message)) {
+        recordedDeprecations.push(new Deprecation(message))
+    }
+}
+
+export function failOnUseOfRemovedFeature(removalMessage: string, deprecationMessage: string = removalMessage): void {
+    const deprecation = new Deprecation(deprecationMessage)
+    const errorMessage = `${removalMessage}.\nSee ${deprecation.getDocumentationLink()}`
+    recordedErrors.push(errorMessage)
+    core.setFailed(errorMessage)
+}
+
+export function getDeprecations(): Deprecation[] {
+    return recordedDeprecations
+}
+
+export function getErrors(): string[] {
+    return recordedErrors
+}
+
+export function emitDeprecationWarnings(hasJobSummary = true): void {
+    if (recordedDeprecations.length > 0) {
+        core.warning(
+            `This job uses deprecated functionality from the '${getActionId()}' action. Consult the ${hasJobSummary ? 'Job Summary' : 'logs'} for more details.`
+        )
+        for (const deprecation of recordedDeprecations) {
+            core.info(`DEPRECATION: ${deprecation.message}. See ${deprecation.getDocumentationLink()}`)
+        }
+    }
+}
+
+export function saveDeprecationState(): void {
+    core.saveState('deprecation-collector_deprecations', JSON.stringify(recordedDeprecations))
+    core.saveState('deprecation-collector_errors', JSON.stringify(recordedErrors))
+}
+
+export function restoreDeprecationState(): void {
+    const savedDeprecations = core.getState('deprecation-collector_deprecations')
+    if (savedDeprecations) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        JSON.parse(savedDeprecations).forEach((obj: any) => {
+            recordedDeprecations.push(new Deprecation(obj.message))
+        })
+    }
+
+    const savedErrors = core.getState('deprecation-collector_errors')
+    if (savedErrors) {
+        recordedErrors.push(...JSON.parse(savedErrors))
+    }
+}

sources/src/develocity/build-scan.ts

@@ -0,0 +1,39 @@
+import * as core from '@actions/core'
+import {BuildScanConfig} from '../configuration'
+import {setupToken} from './short-lived-token'
+
+export async function setup(config: BuildScanConfig): Promise<void> {
+    maybeExportVariable('DEVELOCITY_INJECTION_INIT_SCRIPT_NAME', 'gradle-actions.inject-develocity.init.gradle')
+    maybeExportVariable('DEVELOCITY_AUTO_INJECTION_CUSTOM_VALUE', 'gradle-actions')
+    if (config.getBuildScanPublishEnabled()) {
+        maybeExportVariable('DEVELOCITY_INJECTION_ENABLED', 'true')
+        maybeExportVariable('DEVELOCITY_PLUGIN_VERSION', '3.18.1')
+        maybeExportVariable('DEVELOCITY_CCUD_PLUGIN_VERSION', '2.0')
+        maybeExportVariable('DEVELOCITY_TERMS_OF_USE_URL', config.getBuildScanTermsOfUseUrl())
+        maybeExportVariable('DEVELOCITY_TERMS_OF_USE_AGREE', config.getBuildScanTermsOfUseAgree())
+    }
+
+    maybeExportVariableNotEmpty('DEVELOCITY_INJECTION_ENABLED', config.getDevelocityInjectionEnabled())
+    maybeExportVariableNotEmpty('DEVELOCITY_URL', config.getDevelocityUrl())
+    maybeExportVariableNotEmpty('DEVELOCITY_ALLOW_UNTRUSTED_SERVER', config.getDevelocityAllowUntrustedServer())
+    maybeExportVariableNotEmpty('DEVELOCITY_CAPTURE_FILE_FINGERPRINTS', config.getDevelocityCaptureFileFingerprints())
+    maybeExportVariableNotEmpty('DEVELOCITY_ENFORCE_URL', config.getDevelocityEnforceUrl())
+    maybeExportVariableNotEmpty('DEVELOCITY_PLUGIN_VERSION', config.getDevelocityPluginVersion())
+    maybeExportVariableNotEmpty('GRADLE_PLUGIN_REPOSITORY_URL', config.getGradlePluginRepositoryUrl())
+    maybeExportVariableNotEmpty('GRADLE_PLUGIN_REPOSITORY_USERNAME', config.getGradlePluginRepositoryUsername())
+    maybeExportVariableNotEmpty('GRADLE_PLUGIN_REPOSITORY_PASSWORD', config.getGradlePluginRepositoryPassword())
+
+    return setupToken(config.getDevelocityAccessKey(), config.getDevelocityTokenExpiry())
+}
+
+function maybeExportVariable(variableName: string, value: unknown): void {
+    if (!process.env[variableName]) {
+        core.exportVariable(variableName, value)
+    }
+}
+
+function maybeExportVariableNotEmpty(variableName: string, value: unknown): void {
+    if (value !== null && value !== undefined && value !== '') {
+        maybeExportVariable(variableName, value)
+    }
+}

sources/src/develocity/short-lived-token.ts

@@ -0,0 +1,160 @@
+import * as httpm from 'typed-rest-client/HttpClient'
+import * as core from '@actions/core'
+import {BuildScanConfig} from '../configuration'
+import {recordDeprecation} from '../deprecation-collector'
+
+export async function setupToken(develocityAccessKey: string, develocityTokenExpiry: string): Promise<void> {
+    if (develocityAccessKey) {
+        try {
+            core.debug('Fetching short-lived token...')
+            const tokens = await getToken(develocityAccessKey, develocityTokenExpiry)
+            if (tokens != null && !tokens.isEmpty()) {
+                core.debug(`Got token(s), setting the access key env vars`)
+                const token = tokens.raw()
+                core.setSecret(token)
+                exportAccessKeyEnvVars(token)
+            } else {
+                handleMissingAccessToken()
+            }
+        } catch (e) {
+            handleMissingAccessToken()
+            core.warning(`Failed to fetch short-lived token, reason: ${e}`)
+        }
+    }
+}
+
+function exportAccessKeyEnvVars(value: string): void {
+    ;[BuildScanConfig.DevelocityAccessKeyEnvVar, BuildScanConfig.GradleEnterpriseAccessKeyEnvVar].forEach(key =>
+        core.exportVariable(key, value)
+    )
+}
+
+function handleMissingAccessToken(): void {
+    core.warning(`Failed to fetch short-lived token for Develocity`)
+
+    if (process.env[BuildScanConfig.GradleEnterpriseAccessKeyEnvVar]) {
+        // We do not clear the GRADLE_ENTERPRISE_ACCESS_KEY env var in v3, to let the users upgrade to DV 2024.1
+        recordDeprecation(`The ${BuildScanConfig.GradleEnterpriseAccessKeyEnvVar} env var is deprecated`)
+    }
+    if (process.env[BuildScanConfig.DevelocityAccessKeyEnvVar]) {
+        core.warning(`The ${BuildScanConfig.DevelocityAccessKeyEnvVar} env var should be mapped to a short-lived token`)
+    }
+}
+
+export async function getToken(accessKey: string, expiry: string): Promise<DevelocityAccessCredentials | null> {
+    const empty: Promise<DevelocityAccessCredentials | null> = new Promise(r => r(null))
+    const develocityAccessKey = DevelocityAccessCredentials.parse(accessKey)
+    const shortLivedTokenClient = new ShortLivedTokenClient()
+
+    if (develocityAccessKey == null) {
+        return empty
+    }
+    const tokens = new Array<HostnameAccessKey>()
+    for (const k of develocityAccessKey.keys) {
+        try {
+            core.info(`Requesting short-lived Develocity access token for ${k.hostname}`)
+            const token = await shortLivedTokenClient.fetchToken(`https://${k.hostname}`, k, expiry)
+            tokens.push(token)
+        } catch (e) {
+            // Ignore failure to obtain token
+            core.info(`Failed to obtain short-lived Develocity access token for ${k.hostname}: ${e}`)
+        }
+    }
+    if (tokens.length > 0) {
+        return DevelocityAccessCredentials.of(tokens)
+    }
+    return empty
+}
+
+class ShortLivedTokenClient {
+    httpc = new httpm.HttpClient('gradle/actions/setup-gradle')
+    maxRetries = 3
+    retryInterval = 1000
+
+    async fetchToken(serverUrl: string, accessKey: HostnameAccessKey, expiry: string): Promise<HostnameAccessKey> {
+        const queryParams = expiry ? `?expiresInHours=${expiry}` : ''
+        const sanitizedServerUrl = !serverUrl.endsWith('/') ? `${serverUrl}/` : serverUrl
+        const headers = {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${accessKey.key}`
+        }
+
+        let attempts = 0
+        while (attempts < this.maxRetries) {
+            try {
+                const requestUrl = `${sanitizedServerUrl}api/auth/token${queryParams}`
+                core.debug(`Attempt ${attempts} to fetch short lived token at ${requestUrl}`)
+                const response = await this.httpc.post(requestUrl, '', headers)
+                if (response.message.statusCode === 200) {
+                    const text = await response.readBody()
+                    return new Promise<HostnameAccessKey>(resolve => resolve({hostname: accessKey.hostname, key: text}))
+                }
+                // This should be only 404
+                attempts++
+                if (attempts === this.maxRetries) {
+                    return new Promise((resolve, reject) =>
+                        reject(
+                            new Error(
+                                `Develocity short lived token request failed ${serverUrl} with status code ${response.message.statusCode}`
+                            )
+                        )
+                    )
+                }
+            } catch (error) {
+                attempts++
+                if (attempts === this.maxRetries) {
+                    return new Promise((resolve, reject) => reject(error))
+                }
+            }
+            await new Promise(resolve => setTimeout(resolve, this.retryInterval))
+        }
+        return new Promise((resolve, reject) => reject(new Error('Illegal state')))
+    }
+}
+
+type HostnameAccessKey = {
+    hostname: string
+    key: string
+}
+
+export class DevelocityAccessCredentials {
+    static readonly accessKeyRegexp = /^([^;=\s]+=\w+)(;[^;=\s]+=\w+)*$/
+    readonly keys: HostnameAccessKey[]
+
+    private constructor(allKeys: HostnameAccessKey[]) {
+        this.keys = allKeys
+    }
+
+    static of(allKeys: HostnameAccessKey[]): DevelocityAccessCredentials {
+        return new DevelocityAccessCredentials(allKeys)
+    }
+
+    private static readonly keyDelimiter = ';'
+    private static readonly hostDelimiter = '='
+
+    static parse(rawKey: string): DevelocityAccessCredentials | null {
+        if (!this.isValid(rawKey)) {
+            return null
+        }
+        return new DevelocityAccessCredentials(
+            rawKey.split(this.keyDelimiter).map(hostKey => {
+                const pair = hostKey.split(this.hostDelimiter)
+                return {hostname: pair[0], key: pair[1]}
+            })
+        )
+    }
+
+    isEmpty(): boolean {
+        return this.keys.length === 0
+    }
+
+    raw(): string {
+        return this.keys
+            .map(k => `${k.hostname}${DevelocityAccessCredentials.hostDelimiter}${k.key}`)
+            .join(DevelocityAccessCredentials.keyDelimiter)
+    }
+
+    private static isValid(allKeys: string): boolean {
+        return this.accessKeyRegexp.test(allKeys)
+    }
+}

sources/src/errors.ts

@@ -0,0 +1,49 @@
+import * as core from '@actions/core'
+
+export class JobFailure extends Error {
+    constructor(error: unknown) {
+        if (error instanceof Error) {
+            super(error.message)
+            this.name = error.name
+            this.stack = error.stack
+        } else {
+            super(String(error))
+        }
+    }
+}
+
+export function handleMainActionError(error: unknown): void {
+    if (error instanceof AggregateError) {
+        core.setFailed(`Multiple errors returned`)
+        for (const err of error.errors) {
+            core.error(`Error ${error.errors.indexOf(err)}: ${err.message}`)
+            if (err.stack) {
+                core.info(err.stack)
+            }
+        }
+    } else if (error instanceof JobFailure) {
+        core.setFailed(String(error))
+        if (error.stack) {
+            core.info(error.stack)
+        }
+    } else {
+        core.setFailed(String(error))
+        if (error instanceof Error && error.stack) {
+            core.info(error.stack)
+        }
+    }
+}
+
+export function handlePostActionError(error: unknown): void {
+    if (error instanceof JobFailure) {
+        core.setFailed(String(error))
+        if (error.stack) {
+            core.info(error.stack)
+        }
+    } else {
+        core.warning(`Unhandled error in Gradle post-action - job will continue: ${error}`)
+        if (error instanceof Error && error.stack) {
+            core.info(error.stack)
+        }
+    }
+}

sources/src/execution/gradle.ts

@@ -0,0 +1,74 @@
+import * as core from '@actions/core'
+import * as exec from '@actions/exec'
+
+import which from 'which'
+import * as semver from 'semver'
+import * as provisioner from './provision'
+import * as gradlew from './gradlew'
+
+export async function provisionAndMaybeExecute(
+    gradleVersion: string,
+    buildRootDirectory: string,
+    args: string[]
+): Promise<void> {
+    // Download and install Gradle if required
+    const executable = await provisioner.provisionGradle(gradleVersion)
+
+    // Only execute if arguments have been provided
+    if (args.length > 0) {
+        await executeGradleBuild(executable, buildRootDirectory, args)
+    }
+}
+
+async function executeGradleBuild(executable: string | undefined, root: string, args: string[]): Promise<void> {
+    // Use the provided executable, or look for a Gradle wrapper script to run
+    const toExecute = executable ?? gradlew.gradleWrapperScript(root)
+
+    const status: number = await exec.exec(toExecute, args, {
+        cwd: root,
+        ignoreReturnCode: true
+    })
+
+    if (status !== 0) {
+        core.setFailed(`Gradle build failed: see console output for details`)
+    }
+}
+
+export function versionIsAtLeast(actualVersion: string, requiredVersion: string): boolean {
+    const splitVersion = actualVersion.split('-')
+    const coreVersion = splitVersion[0]
+    const prerelease = splitVersion.length > 1
+
+    const actualSemver = semver.coerce(coreVersion)!
+    const comparisonSemver = semver.coerce(requiredVersion)!
+
+    if (prerelease) {
+        return semver.gt(actualSemver, comparisonSemver)
+    } else {
+        return semver.gte(actualSemver, comparisonSemver)
+    }
+}
+
+export async function findGradleVersionOnPath(): Promise<GradleExecutable | undefined> {
+    const gradleExecutable = await which('gradle', {nothrow: true})
+    if (gradleExecutable) {
+        const output = await exec.getExecOutput(gradleExecutable, ['-v'], {silent: true})
+        const version = parseGradleVersionFromOutput(output.stdout)
+        return version ? new GradleExecutable(version, gradleExecutable) : undefined
+    }
+
+    return undefined
+}
+
+export function parseGradleVersionFromOutput(output: string): string | undefined {
+    const regex = /Gradle (\d+\.\d+(\.\d+)?(-.*)?)/
+    const versionString = output.match(regex)?.[1]
+    return versionString
+}
+
+class GradleExecutable {
+    constructor(
+        readonly version: string,
+        readonly executable: string
+    ) {}
+}

sources/src/execution/gradlew.ts

@@ -0,0 +1,46 @@
+import * as core from '@actions/core'
+import * as path from 'path'
+import fs from 'fs'
+
+const IS_WINDOWS = process.platform === 'win32'
+
+export function wrapperScriptFilename(): string {
+    return IS_WINDOWS ? './gradlew.bat' : './gradlew'
+}
+
+export function installScriptFilename(): string {
+    return IS_WINDOWS ? 'gradle.bat' : 'gradle'
+}
+
+export function gradleWrapperScript(buildRootDirectory: string): string {
+    validateGradleWrapper(buildRootDirectory)
+    return wrapperScriptFilename()
+}
+
+function validateGradleWrapper(buildRootDirectory: string): void {
+    const wrapperScript = path.resolve(buildRootDirectory, wrapperScriptFilename())
+    verifyExists(wrapperScript, 'Gradle Wrapper script')
+    verifyIsExecutableScript(wrapperScript)
+
+    const wrapperProperties = path.resolve(buildRootDirectory, 'gradle/wrapper/gradle-wrapper.properties')
+    verifyExists(wrapperProperties, 'Gradle wrapper properties file')
+}
+
+function verifyExists(file: string, description: string): void {
+    if (!fs.existsSync(file)) {
+        throw new Error(
+            `Cannot locate ${description} at '${file}'. Specify 'gradle-version' for projects without Gradle wrapper configured.`
+        )
+    }
+}
+
+function verifyIsExecutableScript(toExecute: string): void {
+    try {
+        fs.accessSync(toExecute, fs.constants.X_OK)
+    } catch (err) {
+        core.warning(
+            `Gradle wrapper script '${toExecute}' is not executable. Action will set executable permission and continue.`
+        )
+        fs.chmodSync(toExecute, '755')
+    }
+}

sources/src/execution/provision.ts

@@ -0,0 +1,217 @@
+import * as fs from 'fs'
+import * as os from 'os'
+import * as path from 'path'
+import * as httpm from '@actions/http-client'
+import * as core from '@actions/core'
+import * as cache from '@actions/cache'
+import * as toolCache from '@actions/tool-cache'
+
+import {findGradleVersionOnPath, versionIsAtLeast} from './gradle'
+import * as gradlew from './gradlew'
+import {handleCacheFailure} from '../caching/cache-utils'
+import {CacheConfig} from '../configuration'
+
+const gradleVersionsBaseUrl = 'https://services.gradle.org/versions'
+
+/**
+ * Install any configured version of Gradle, adding the executable to the PATH.
+ * @return Installed Gradle executable or undefined if no version configured.
+ */
+export async function provisionGradle(gradleVersion: string): Promise<string | undefined> {
+    if (gradleVersion !== '' && gradleVersion !== 'wrapper') {
+        return addToPath(await installGradle(gradleVersion))
+    }
+
+    return undefined
+}
+
+/**
+ * Ensure that the Gradle version on PATH is no older than the specified version.
+ * If the version on PATH is older, install the specified version and add it to the PATH.
+ * @return Installed Gradle executable or undefined if no version configured.
+ */
+export async function provisionGradleAtLeast(gradleVersion: string): Promise<string> {
+    const installedVersion = await installGradleVersionAtLeast(await gradleRelease(gradleVersion))
+    return addToPath(installedVersion)
+}
+
+async function addToPath(executable: string): Promise<string> {
+    core.addPath(path.dirname(executable))
+    return executable
+}
+
+async function installGradle(version: string): Promise<string> {
+    const versionInfo = await resolveGradleVersion(version)
+    core.setOutput('gradle-version', versionInfo.version)
+    return installGradleVersion(versionInfo)
+}
+
+async function resolveGradleVersion(version: string): Promise<GradleVersionInfo> {
+    switch (version) {
+        case 'current':
+            return gradleCurrent()
+        case 'rc':
+            core.warning(`Specifying gradle-version 'rc' has been deprecated. Use 'release-candidate' instead.`)
+            return gradleReleaseCandidate()
+        case 'release-candidate':
+            return gradleReleaseCandidate()
+        case 'nightly':
+            return gradleNightly()
+        case 'release-nightly':
+            return gradleReleaseNightly()
+        default:
+            return gradleRelease(version)
+    }
+}
+
+async function gradleCurrent(): Promise<GradleVersionInfo> {
+    return await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/current`)
+}
+
+async function gradleReleaseCandidate(): Promise<GradleVersionInfo> {
+    const versionInfo = await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/release-candidate`)
+    if (versionInfo && versionInfo.version && versionInfo.downloadUrl) {
+        return versionInfo
+    }
+    core.info('No current release-candidate found, will fallback to current')
+    return gradleCurrent()
+}
+
+async function gradleNightly(): Promise<GradleVersionInfo> {
+    return await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/nightly`)
+}
+
+async function gradleReleaseNightly(): Promise<GradleVersionInfo> {
+    return await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/release-nightly`)
+}
+
+async function gradleRelease(version: string): Promise<GradleVersionInfo> {
+    const versionInfo = await findGradleVersionDeclaration(version)
+    if (!versionInfo) {
+        throw new Error(`Gradle version ${version} does not exists`)
+    }
+    return versionInfo
+}
+
+async function gradleVersionDeclaration(url: string): Promise<GradleVersionInfo> {
+    return await httpGetGradleVersion(url)
+}
+
+async function findGradleVersionDeclaration(version: string): Promise<GradleVersionInfo | undefined> {
+    const gradleVersions = await httpGetGradleVersions(`${gradleVersionsBaseUrl}/all`)
+    return gradleVersions.find((entry: GradleVersionInfo) => {
+        return entry.version === version
+    })
+}
+
+async function installGradleVersion(versionInfo: GradleVersionInfo): Promise<string> {
+    return core.group(`Provision Gradle ${versionInfo.version}`, async () => {
+        const gradleOnPath = await findGradleVersionOnPath()
+        if (gradleOnPath?.version === versionInfo.version) {
+            core.info(`Gradle version ${versionInfo.version} is already available on PATH. Not installing.`)
+            return gradleOnPath.executable
+        }
+
+        return locateGradleAndDownloadIfRequired(versionInfo)
+    })
+}
+
+async function installGradleVersionAtLeast(versionInfo: GradleVersionInfo): Promise<string> {
+    return core.group(`Provision Gradle >= ${versionInfo.version}`, async () => {
+        const gradleOnPath = await findGradleVersionOnPath()
+        if (gradleOnPath && versionIsAtLeast(gradleOnPath.version, versionInfo.version)) {
+            core.info(
+                `Gradle version ${gradleOnPath.version} is available on PATH and >= ${versionInfo.version}. Not installing.`
+            )
+            return gradleOnPath.executable
+        }
+
+        return locateGradleAndDownloadIfRequired(versionInfo)
+    })
+}
+
+async function locateGradleAndDownloadIfRequired(versionInfo: GradleVersionInfo): Promise<string> {
+    const installsDir = path.join(getProvisionDir(), 'installs')
+    const installDir = path.join(installsDir, `gradle-${versionInfo.version}`)
+    if (fs.existsSync(installDir)) {
+        core.info(`Gradle installation already exists at ${installDir}`)
+        return executableFrom(installDir)
+    }
+
+    const downloadPath = await downloadAndCacheGradleDistribution(versionInfo)
+    await toolCache.extractZip(downloadPath, installsDir)
+    core.info(`Extracted Gradle ${versionInfo.version} to ${installDir}`)
+
+    const executable = executableFrom(installDir)
+    fs.chmodSync(executable, '755')
+    core.info(`Provisioned Gradle executable ${executable}`)
+
+    return executable
+}
+
+async function downloadAndCacheGradleDistribution(versionInfo: GradleVersionInfo): Promise<string> {
+    const downloadPath = path.join(getProvisionDir(), `downloads/gradle-${versionInfo.version}-bin.zip`)
+
+    // TODO: Convert this to a class and inject config
+    const cacheConfig = new CacheConfig()
+    if (cacheConfig.isCacheDisabled()) {
+        await downloadGradleDistribution(versionInfo, downloadPath)
+        return downloadPath
+    }
+
+    const cacheKey = `gradle-${versionInfo.version}`
+    try {
+        const restoreKey = await cache.restoreCache([downloadPath], cacheKey)
+        if (restoreKey) {
+            core.info(`Restored Gradle distribution ${cacheKey} from cache to ${downloadPath}`)
+            return downloadPath
+        }
+    } catch (error) {
+        handleCacheFailure(error, `Restore Gradle distribution ${versionInfo.version} failed`)
+    }
+
+    core.info(`Gradle distribution ${versionInfo.version} not found in cache. Will download.`)
+    await downloadGradleDistribution(versionInfo, downloadPath)
+
+    if (!cacheConfig.isCacheReadOnly()) {
+        try {
+            await cache.saveCache([downloadPath], cacheKey)
+        } catch (error) {
+            handleCacheFailure(error, `Save Gradle distribution ${versionInfo.version} failed`)
+        }
+    }
+    return downloadPath
+}
+
+function getProvisionDir(): string {
+    const tmpDir = process.env['RUNNER_TEMP'] ?? os.tmpdir()
+    return path.join(tmpDir, `.gradle-actions/gradle-installations`)
+}
+
+async function downloadGradleDistribution(versionInfo: GradleVersionInfo, downloadPath: string): Promise<void> {
+    await toolCache.downloadTool(versionInfo.downloadUrl, downloadPath)
+    core.info(`Downloaded ${versionInfo.downloadUrl} to ${downloadPath} (size ${fs.statSync(downloadPath).size})`)
+}
+
+function executableFrom(installDir: string): string {
+    return path.join(installDir, 'bin', `${gradlew.installScriptFilename()}`)
+}
+
+async function httpGetGradleVersion(url: string): Promise<GradleVersionInfo> {
+    return JSON.parse(await httpGetString(url))
+}
+
+async function httpGetGradleVersions(url: string): Promise<GradleVersionInfo[]> {
+    return JSON.parse(await httpGetString(url))
+}
+
+async function httpGetString(url: string): Promise<string> {
+    const httpClient = new httpm.HttpClient('gradle/actions')
+    const response = await httpClient.get(url)
+    return response.readBody()
+}
+
+interface GradleVersionInfo {
+    version: string
+    downloadUrl: string
+}

sources/src/job-summary.ts

@@ -0,0 +1,201 @@
+import * as core from '@actions/core'
+import * as github from '@actions/github'
+import {RequestError} from '@octokit/request-error'
+
+import {BuildResults, BuildResult} from './build-results'
+import {SummaryConfig, getActionId, getGithubToken} from './configuration'
+import {Deprecation, getDeprecations, getErrors} from './deprecation-collector'
+
+export async function generateJobSummary(
+    buildResults: BuildResults,
+    cachingReport: string,
+    config: SummaryConfig
+): Promise<void> {
+    const errors = renderErrors()
+    if (errors) {
+        core.summary.addRaw(errors)
+        await core.summary.write()
+        return
+    }
+
+    const summaryTable = renderSummaryTable(buildResults.results)
+
+    const hasFailure = buildResults.anyFailed()
+    if (config.shouldGenerateJobSummary(hasFailure)) {
+        core.info('Generating Job Summary')
+
+        core.summary.addRaw(summaryTable)
+        core.summary.addRaw(cachingReport)
+        await core.summary.write()
+    } else {
+        core.info('============================')
+        core.info(summaryTable)
+        core.info('============================')
+        core.info(cachingReport)
+        core.info('============================')
+    }
+
+    if (config.shouldAddPRComment(hasFailure)) {
+        await addPRComment(summaryTable)
+    }
+}
+
+async function addPRComment(jobSummary: string): Promise<void> {
+    const context = github.context
+    if (context.payload.pull_request == null) {
+        core.info('No pull_request trigger detected: not adding PR comment')
+        return
+    }
+
+    const pull_request_number = context.payload.pull_request.number
+    core.info(`Adding Job Summary as comment to PR #${pull_request_number}.`)
+
+    const prComment = `<h3>Job Summary for Gradle</h3>
+<a href="${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}" target="_blank">
+<h5>${context.workflow} :: <em>${context.job}</em></h5>
+</a>
+
+${jobSummary}`
+
+    const github_token = getGithubToken()
+    const octokit = github.getOctokit(github_token)
+    try {
+        await octokit.rest.issues.createComment({
+            ...context.repo,
+            issue_number: pull_request_number,
+            body: prComment
+        })
+    } catch (error) {
+        if (error instanceof RequestError) {
+            core.warning(buildWarningMessage(error))
+        } else {
+            throw error
+        }
+    }
+}
+
+function buildWarningMessage(error: RequestError): string {
+    const mainWarning = `Failed to generate PR comment.\n${String(error)}`
+    if (error.message === 'Resource not accessible by integration') {
+        return `${mainWarning}
+Please ensure that the 'pull-requests: write' permission is available for the workflow job.
+Note that this permission is never available for a workflow triggered from a repository fork.
+`
+    }
+    return mainWarning
+}
+
+export function renderSummaryTable(results: BuildResult[]): string {
+    return `${renderDeprecations()}\n${renderBuildResults(results)}`
+}
+
+function renderErrors(): string | undefined {
+    const errors = getErrors()
+    if (errors.length === 0) {
+        return undefined
+    }
+    return errors.map(error => `<b>:x: ${error}</b>`).join('\n')
+}
+
+function renderDeprecations(): string {
+    const deprecations = getDeprecations()
+    if (deprecations.length === 0) {
+        return ''
+    }
+    return `
+<h4>Deprecation warnings</h4>
+This job uses deprecated functionality from the <code>${getActionId()}</code> action. Follow the links for upgrade details.
+<ul>
+    ${deprecations.map(deprecation => `<li>${getDeprecationHtml(deprecation)}</li>`).join('')}
+</ul>
+
+<h4>Gradle Build Results</h4>`
+}
+
+function getDeprecationHtml(deprecation: Deprecation): string {
+    return `<a href="${deprecation.getDocumentationLink()}" target="_blank">${deprecation.message}</a>`
+}
+
+function renderBuildResults(results: BuildResult[]): string {
+    if (results.length === 0) {
+        return '<b>No Gradle build results detected.</b>'
+    }
+
+    return `
+<table>
+    <tr>
+        <th>Gradle Root Project</th>
+        <th>Requested Tasks</th>
+        <th>Gradle Version</th>
+        <th>Build Outcome</th>
+        <th>Build&nbsp;Scan®</th>
+    </tr>${results.map(result => renderBuildResultRow(result)).join('')}
+</table>
+    `
+}
+
+function renderBuildResultRow(result: BuildResult): string {
+    return `
+    <tr>
+        <td>${truncateString(result.rootProjectName, 30)}</td>
+        <td>${truncateString(result.requestedTasks, 60)}</td>
+        <td align='center'>${result.gradleVersion}</td>
+        <td align='center'>${renderOutcome(result)}</td>
+        <td>${renderBuildScan(result)}</td>
+    </tr>`
+}
+
+function renderOutcome(result: BuildResult): string {
+    return result.buildFailed ? ':x:' : ':white_check_mark:'
+}
+
+interface BadgeSpec {
+    text: string
+    alt: string
+    color: string
+    logo: boolean
+    targetUrl: string
+}
+
+function renderBuildScan(result: BuildResult): string {
+    if (result.buildScanFailed) {
+        return renderBuildScanBadge({
+            text: 'Publish failed',
+            alt: 'Build Scan publish failed',
+            color: 'orange',
+            logo: false,
+            targetUrl: 'https://docs.gradle.com/develocity/gradle-plugin/#troubleshooting'
+        })
+    }
+    if (result.buildScanUri) {
+        return renderBuildScanBadge({
+            text: 'Build Scan®',
+            alt: 'Build Scan published',
+            color: '06A0CE',
+            logo: true,
+            targetUrl: result.buildScanUri
+        })
+    }
+    return renderBuildScanBadge({
+        text: 'Not published',
+        alt: 'Build Scan not published',
+        color: 'lightgrey',
+        logo: false,
+        targetUrl: 'https://scans.gradle.com'
+    })
+}
+
+function renderBuildScanBadge({text, alt, color, logo, targetUrl}: BadgeSpec): string {
+    const encodedText = encodeURIComponent(text)
+    const badgeUrl = `https://img.shields.io/badge/${encodedText}-${color}${logo ? '?logo=Gradle' : ''}`
+    const badgeHtml = `<img src="${badgeUrl}" alt="${alt}" />`
+    return `<a href="${targetUrl}" rel="nofollow" target="_blank">${badgeHtml}</a>`
+}
+
+function truncateString(str: string, maxLength: number): string {
+    if (str.length > maxLength) {
+        return `<div title='${str}'>${str.slice(0, maxLength - 1)}…</div>`
+    } else {
+        return str
+    }
+}

sources/src/resources/init-scripts/gradle-actions.build-result-capture-service.plugin.groovy

@@ -0,0 +1,78 @@
+import org.gradle.tooling.events.*
+import org.gradle.tooling.events.task.*
+import org.gradle.internal.operations.*
+import org.gradle.initialization.*
+import org.gradle.api.internal.tasks.execution.*
+import org.gradle.execution.*
+import org.gradle.internal.build.event.BuildEventListenerRegistryInternal
+import org.gradle.util.GradleVersion
+
+settingsEvaluated { settings ->
+    def projectTracker = gradle.sharedServices.registerIfAbsent("gradle-action-buildResultsRecorder", BuildResultsRecorder, { spec ->
+        spec.getParameters().getRootProjectName().set(settings.rootProject.name)
+        spec.getParameters().getRootProjectDir().set(settings.rootDir.absolutePath)
+        spec.getParameters().getRequestedTasks().set(gradle.startParameter.taskNames.join(" "))
+        spec.getParameters().getGradleHomeDir().set(gradle.gradleHomeDir.absolutePath)
+        spec.getParameters().getInvocationId().set(gradle.ext.invocationId)
+    })
+
+    gradle.services.get(BuildEventListenerRegistryInternal).onOperationCompletion(projectTracker)
+}
+
+abstract class BuildResultsRecorder implements BuildService<BuildResultsRecorder.Params>, BuildOperationListener, AutoCloseable {
+    private boolean buildFailed = false
+    private boolean configCacheHit = true
+    interface Params extends BuildServiceParameters {
+        Property<String> getRootProjectName()
+        Property<String> getRootProjectDir()
+        Property<String> getRequestedTasks()
+        Property<String> getGradleHomeDir()
+        Property<String> getInvocationId()
+    }
+
+    void started(BuildOperationDescriptor buildOperation, OperationStartEvent startEvent) {}
+
+    void progress(OperationIdentifier operationIdentifier, OperationProgressEvent progressEvent) {}
+
+    void finished(BuildOperationDescriptor buildOperation, OperationFinishEvent finishEvent) {
+        if (buildOperation.details in EvaluateSettingsBuildOperationType.Details) {
+            // Got EVALUATE SETTINGS event: not a config-cache hit"
+            configCacheHit = false
+        }
+        if (buildOperation.details in RunRootBuildWorkBuildOperationType.Details) {
+            if (finishEvent.failure != null) {
+                buildFailed = true
+            }
+        }
+    }
+
+    @Override
+    public void close() {
+        def buildResults = [
+            rootProjectName: getParameters().getRootProjectName().get(),
+            rootProjectDir: getParameters().getRootProjectDir().get(),
+            requestedTasks: getParameters().getRequestedTasks().get(),
+            gradleVersion: GradleVersion.current().version,
+            gradleHomeDir: getParameters().getGradleHomeDir().get(),
+            buildFailed: buildFailed,
+            configCacheHit: configCacheHit
+        ]
+
+        def runnerTempDir = System.getProperty("RUNNER_TEMP") ?: System.getenv("RUNNER_TEMP")
+        def githubActionStep = System.getProperty("GITHUB_ACTION") ?: System.getenv("GITHUB_ACTION")
+        if (!runnerTempDir || !githubActionStep) {
+            return
+        }
+
+        try {
+            def buildResultsDir = new File(runnerTempDir, ".gradle-actions/build-results")
+            buildResultsDir.mkdirs()
+            def buildResultsFile = new File(buildResultsDir, githubActionStep + getParameters().getInvocationId().get() + ".json")
+            if (!buildResultsFile.exists()) {
+                buildResultsFile << groovy.json.JsonOutput.toJson(buildResults)
+            }
+        } catch (Exception e) {
+            println "\ngradle action failed to write build-results file. Will continue.\n> ${e.getLocalizedMessage()}"
+        }
+    }
+}

sources/src/resources/init-scripts/gradle-actions.build-result-capture.init.gradle

@@ -0,0 +1,135 @@
+/*
+ * Capture information for each executed Gradle build to display in the job summary.
+ */
+import org.gradle.util.GradleVersion
+
+def BUILD_SCAN_PLUGIN_ID = "com.gradle.build-scan"
+def BUILD_SCAN_EXTENSION = "buildScan"
+def DEVELOCITY_PLUGIN_ID = "com.gradle.develocity"
+def DEVELOCITY_EXTENSION = "develocity"
+def GE_PLUGIN_ID = "com.gradle.enterprise"
+def GE_EXTENSION = "gradleEnterprise"
+
+// Only run against root build. Do not run against included builds.
+def isTopLevelBuild = gradle.getParent() == null
+if (isTopLevelBuild) {
+    def resultsWriter = new ResultsWriter()
+    def version = GradleVersion.current().baseVersion
+
+    def atLeastGradle3 = version >= GradleVersion.version("3.0")
+    def atLeastGradle6 = version >= GradleVersion.version("6.0")
+
+    def invocationId = "-${System.currentTimeMillis()}"
+
+    if (atLeastGradle6) {
+        // By default, use standard mechanisms to capture build results
+        def useBuildService = version >= GradleVersion.version("6.6")
+        if (useBuildService) {
+            captureUsingBuildService(invocationId)
+        } else {
+            captureUsingBuildFinished(gradle, invocationId, resultsWriter)
+        }
+
+        // Use the Develocity plugin to also capture build scan links, when available
+        settingsEvaluated { settings ->
+            settings.pluginManager.withPlugin(GE_PLUGIN_ID) {
+                // Only execute if develocity plugin isn't applied.
+                if (!settings.extensions.findByName(DEVELOCITY_EXTENSION)) {
+                    captureUsingBuildScanPublished(settings.extensions[GE_EXTENSION].buildScan, invocationId, resultsWriter)
+                }
+            }
+
+            settings.pluginManager.withPlugin(DEVELOCITY_PLUGIN_ID) {
+                captureUsingBuildScanPublished(settings.extensions[DEVELOCITY_EXTENSION].buildScan, invocationId, resultsWriter)
+            }
+        }
+    } else if (atLeastGradle3) {
+        projectsEvaluated { gradle ->
+            // By default, use 'buildFinished' to capture build results
+            captureUsingBuildFinished(gradle, invocationId, resultsWriter)
+
+            gradle.rootProject.pluginManager.withPlugin(BUILD_SCAN_PLUGIN_ID) {
+                // Only execute if develocity plugin isn't applied.
+                if (!gradle.rootProject.extensions.findByName(DEVELOCITY_EXTENSION)) {
+                    captureUsingBuildScanPublished(gradle.rootProject.extensions[BUILD_SCAN_EXTENSION], invocationId, resultsWriter)
+                }
+            }
+
+            gradle.rootProject.pluginManager.withPlugin(DEVELOCITY_PLUGIN_ID) {
+                captureUsingBuildScanPublished(gradle.rootProject.extensions[DEVELOCITY_EXTENSION].buildScan, invocationId, resultsWriter)
+            }
+        }
+    }
+}
+
+def captureUsingBuildService(invocationId) {
+    gradle.ext.invocationId = invocationId
+    apply from: 'gradle-actions.build-result-capture-service.plugin.groovy'
+}
+
+void captureUsingBuildFinished(gradle, String invocationId, ResultsWriter resultsWriter) {
+    gradle.buildFinished { result ->
+        println "Got buildFinished: ${result}"
+        def buildResults = [
+            rootProjectName: rootProject.name,
+            rootProjectDir: rootProject.projectDir.absolutePath,
+            requestedTasks: gradle.startParameter.taskNames.join(" "),
+            gradleVersion: GradleVersion.current().version,
+            gradleHomeDir: gradle.gradleHomeDir.absolutePath,
+            buildFailed: result.failure != null,
+            configCacheHit: false
+        ]
+        resultsWriter.writeToResultsFile("build-results", invocationId, buildResults)
+    }
+}
+
+// The `buildScanPublished` hook allows the capture of the Build Scan URI.
+// Results captured this way will overwrite any results from 'buildFinished'.
+void captureUsingBuildScanPublished(buildScanExtension, String invocationId, ResultsWriter resultsWriter) {
+    buildScanExtension.with {
+        buildScanPublished { buildScan ->
+            def scanResults = [
+                buildScanUri: buildScan.buildScanUri.toASCIIString(),
+                buildScanFailed: false
+            ]
+            resultsWriter.writeToResultsFile("build-scans", invocationId, scanResults)
+
+            def githubOutput = System.getenv("GITHUB_OUTPUT")
+            if (githubOutput) {
+                new File(githubOutput) << "build-scan-url=${buildScan.buildScanUri}\n"
+            } else {
+                // Retained for compatibility with older GHES versions
+                println("::set-output name=build-scan-url::${buildScan.buildScanUri}")
+            }
+        }
+
+        onError { error ->
+            def scanResults = [
+                buildScanUri: null,
+                buildScanFailed: true
+            ]
+            resultsWriter.writeToResultsFile("build-scans", invocationId, scanResults)
+        }
+    }
+}
+
+class ResultsWriter {
+    void writeToResultsFile(String subDir, String invocationId, def content) {
+        def runnerTempDir = System.getProperty("RUNNER_TEMP") ?: System.getenv("RUNNER_TEMP")
+        def githubActionStep = System.getProperty("GITHUB_ACTION") ?: System.getenv("GITHUB_ACTION")
+        if (!runnerTempDir || !githubActionStep) {
+            return
+        }
+
+        try {
+            def buildResultsDir = new File(runnerTempDir, ".gradle-actions/${subDir}")
+            buildResultsDir.mkdirs()
+            def buildResultsFile = new File(buildResultsDir, githubActionStep + invocationId + ".json")
+            if (!buildResultsFile.exists()) {
+                buildResultsFile << groovy.json.JsonOutput.toJson(content)
+            }
+        } catch (Exception e) {
+            println "\ngradle action failed to write build-results file. Will continue.\n> ${e.getLocalizedMessage()}"
+        }
+    }
+}

sources/src/resources/init-scripts/gradle-actions.github-dependency-graph-gradle-plugin-apply.groovy

@@ -0,0 +1,32 @@
+buildscript {
+  def getInputParam = { String name ->
+      def envVarName = name.toUpperCase().replace('.', '_').replace('-', '_')
+      return System.getProperty(name) ?: System.getenv(envVarName)
+  }
+  def pluginRepositoryUrl = getInputParam('gradle.plugin-repository.url') ?: 'https://plugins.gradle.org/m2'
+  def pluginRepositoryUsername = getInputParam('gradle.plugin-repository.username')
+  def pluginRepositoryPassword = getInputParam('gradle.plugin-repository.password')
+  def dependencyGraphPluginVersion = getInputParam('dependency-graph-plugin.version') ?: '1.3.1'
+
+  logger.lifecycle("Resolving dependency graph plugin ${dependencyGraphPluginVersion} from plugin repository: ${pluginRepositoryUrl}")
+  repositories {
+    maven { 
+      url pluginRepositoryUrl 
+      if (pluginRepositoryUsername && pluginRepositoryPassword) {
+        logger.lifecycle("Applying credentials for plugin repository: ${pluginRepositoryUrl}")
+        credentials {
+          username(pluginRepositoryUsername)
+          password(pluginRepositoryPassword)
+        }
+        authentication {
+          basic(BasicAuthentication)
+        }
+      }
+    }
+  }
+  dependencies {
+    classpath "org.gradle:github-dependency-graph-gradle-plugin:${dependencyGraphPluginVersion}"
+  }
+}
+
+apply plugin: org.gradle.github.GitHubDependencyGraphPlugin

sources/src/resources/init-scripts/gradle-actions.github-dependency-graph.init.gradle

@@ -0,0 +1,65 @@
+import org.gradle.util.GradleVersion
+
+// Only run when dependency graph is explicitly enabled
+if (getVariable('GITHUB_DEPENDENCY_GRAPH_ENABLED') != "true") {
+  return
+}
+
+// Do not run for unsupported versions of Gradle
+def gradleVersion = GradleVersion.current().baseVersion
+if (gradleVersion < GradleVersion.version("5.2") ||
+    (gradleVersion >= GradleVersion.version("7.0") && gradleVersion < GradleVersion.version("7.1"))) {
+  if (getVariable('GITHUB_DEPENDENCY_GRAPH_CONTINUE_ON_FAILURE') != "true") {
+    throw new GradleException("Dependency Graph is not supported for ${gradleVersion}. No dependency snapshot will be generated.")
+  }
+  logger.warn("::warning::Dependency Graph is not supported for ${gradleVersion}. No dependency snapshot will be generated.")
+  return
+}
+
+// Attempt to find a unique job correlator to use based on the environment variable
+// This is only required for top-level builds
+def isTopLevelBuild = gradle.getParent() == null
+if (isTopLevelBuild) {
+  def reportFile = getUniqueReportFile(getVariable('GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR'))
+
+  if (reportFile == null) {
+    logger.warn("::warning::No dependency snapshot generated for step. Could not determine unique job correlator - specify GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR var for this step.")
+    return
+  }
+
+  logger.lifecycle("Generating dependency graph into '${reportFile}'")
+}
+
+apply from: 'gradle-actions.github-dependency-graph-gradle-plugin-apply.groovy'
+
+/**
+ * Using the supplied jobCorrelator value:
+ * - Checks if report file already exists
+ * - If so, tries to find a unique value that does not yet have a corresponding report file.
+ * - When found, this value is set as a System property override.
+ */
+File getUniqueReportFile(String jobCorrelator) {
+    def reportDir = getVariable('DEPENDENCY_GRAPH_REPORT_DIR')
+    def reportFile = new File(reportDir, jobCorrelator + ".json")
+    if (!reportFile.exists()) return reportFile
+
+    // Try at most 100 suffixes
+    for (int i = 1; i < 100; i++) {
+        def candidateCorrelator = jobCorrelator + "-" + i
+        def candidateFile = new File(reportDir, candidateCorrelator + ".json")
+        if (!candidateFile.exists()) {
+           System.properties['GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR'] = candidateCorrelator
+           return candidateFile
+        }
+    }
+
+    // Could not determine unique job correlator
+    return null
+}
+
+/**
+* Return the environment variable value, or equivalent system property (if set)
+*/
+String getVariable(String name) {
+  return System.properties[name] ?: System.getenv(name)
+}

sources/src/resources/init-scripts/gradle-actions.inject-develocity.init.gradle

@@ -0,0 +1,414 @@
+/*
+ * Initscript for injection of Develocity into Gradle builds.
+ * Version: v1.0
+ */
+
+import org.gradle.util.GradleVersion
+
+initscript {
+    // NOTE: there is no mechanism to share code between the initscript{} block and the main script, so some logic is duplicated
+    def isTopLevelBuild = !gradle.parent
+    if (!isTopLevelBuild) {
+        return
+    }
+
+    def getInputParam = { String name ->
+        def ENV_VAR_PREFIX = ''
+        def envVarName = ENV_VAR_PREFIX + name.toUpperCase().replace('.', '_').replace('-', '_')
+        return System.getProperty(name) ?: System.getenv(envVarName)
+    }
+
+    def requestedInitScriptName = getInputParam('develocity.injection.init-script-name')
+    def initScriptName = buildscript.sourceFile.name
+    if (requestedInitScriptName != initScriptName) {
+        return
+    }
+
+    // Plugin loading is only required for Develocity injection. Abort early if not enabled.
+    def develocityInjectionEnabled = Boolean.parseBoolean(getInputParam("develocity.injection-enabled"))
+    if (!develocityInjectionEnabled) {
+        return
+    }
+
+    def pluginRepositoryUrl = getInputParam('gradle.plugin-repository.url')
+    def pluginRepositoryUsername = getInputParam('gradle.plugin-repository.username')
+    def pluginRepositoryPassword = getInputParam('gradle.plugin-repository.password')
+    def develocityPluginVersion = getInputParam('develocity.plugin.version')
+    def ccudPluginVersion = getInputParam('develocity.ccud-plugin.version')
+
+    def atLeastGradle5 = GradleVersion.current() >= GradleVersion.version('5.0')
+    def atLeastGradle4 = GradleVersion.current() >= GradleVersion.version('4.0')
+
+    if (develocityPluginVersion || ccudPluginVersion && atLeastGradle4) {
+        pluginRepositoryUrl = pluginRepositoryUrl ?: 'https://plugins.gradle.org/m2'
+        logger.lifecycle("Develocity plugins resolution: $pluginRepositoryUrl")
+
+        repositories {
+            maven {
+                url pluginRepositoryUrl
+                if (pluginRepositoryUsername && pluginRepositoryPassword) {
+                    logger.lifecycle("Using credentials for plugin repository")
+                    credentials {
+                        username(pluginRepositoryUsername)
+                        password(pluginRepositoryPassword)
+                    }
+                    authentication {
+                        basic(BasicAuthentication)
+                    }
+                }
+            }
+        }
+    }
+
+    dependencies {
+        if (develocityPluginVersion) {
+            if (atLeastGradle5) {
+                if (GradleVersion.version(develocityPluginVersion) >= GradleVersion.version("3.17")) {
+                    classpath "com.gradle:develocity-gradle-plugin:$develocityPluginVersion"
+                } else {
+                    classpath "com.gradle:gradle-enterprise-gradle-plugin:$develocityPluginVersion"
+                }
+            } else {
+                classpath "com.gradle:build-scan-plugin:1.16"
+            }
+        }
+
+        if (ccudPluginVersion && atLeastGradle4) {
+            classpath "com.gradle:common-custom-user-data-gradle-plugin:$ccudPluginVersion"
+        }
+    }
+}
+
+static getInputParam(String name) {
+    def ENV_VAR_PREFIX = ''
+    def envVarName = ENV_VAR_PREFIX + name.toUpperCase().replace('.', '_').replace('-', '_')
+    return System.getProperty(name) ?: System.getenv(envVarName)
+}
+
+def isTopLevelBuild = !gradle.parent
+if (!isTopLevelBuild) {
+    return
+}
+
+def requestedInitScriptName = getInputParam('develocity.injection.init-script-name')
+def initScriptName = buildscript.sourceFile.name
+if (requestedInitScriptName != initScriptName) {
+    logger.quiet("Ignoring init script '${initScriptName}' as requested name '${requestedInitScriptName}' does not match")
+    return
+}
+
+def develocityInjectionEnabled = Boolean.parseBoolean(getInputParam("develocity.injection-enabled"))
+if (develocityInjectionEnabled) {
+    enableDevelocityInjection()
+}
+
+// To enable build-scan capture, a `captureBuildScanLink(String)` method must be added to `BuildScanCollector`.
+def buildScanCollector = new BuildScanCollector()
+def buildScanCaptureEnabled = buildScanCollector.metaClass.respondsTo(buildScanCollector, 'captureBuildScanLink', String)
+if (buildScanCaptureEnabled) {
+    enableBuildScanLinkCapture(buildScanCollector)
+}
+
+void enableDevelocityInjection() {
+    def BUILD_SCAN_PLUGIN_ID = 'com.gradle.build-scan'
+    def BUILD_SCAN_PLUGIN_CLASS = 'com.gradle.scan.plugin.BuildScanPlugin'
+
+    def GRADLE_ENTERPRISE_PLUGIN_ID = 'com.gradle.enterprise'
+    def GRADLE_ENTERPRISE_PLUGIN_CLASS = 'com.gradle.enterprise.gradleplugin.GradleEnterprisePlugin'
+
+    def DEVELOCITY_PLUGIN_ID = 'com.gradle.develocity'
+    def DEVELOCITY_PLUGIN_CLASS = 'com.gradle.develocity.agent.gradle.DevelocityPlugin'
+
+    def CI_AUTO_INJECTION_CUSTOM_VALUE_NAME = 'CI auto injection'
+    def CCUD_PLUGIN_ID = 'com.gradle.common-custom-user-data-gradle-plugin'
+    def CCUD_PLUGIN_CLASS = 'com.gradle.CommonCustomUserDataGradlePlugin'
+
+    def develocityUrl = getInputParam('develocity.url')
+    def develocityAllowUntrustedServer = Boolean.parseBoolean(getInputParam('develocity.allow-untrusted-server'))
+    def develocityEnforceUrl = Boolean.parseBoolean(getInputParam('develocity.enforce-url'))
+    def buildScanUploadInBackground = Boolean.parseBoolean(getInputParam('develocity.build-scan.upload-in-background'))
+    def develocityCaptureFileFingerprints = getInputParam('develocity.capture-file-fingerprints') ? Boolean.parseBoolean(getInputParam('develocity.capture-file-fingerprints')) : true
+    def develocityPluginVersion = getInputParam('develocity.plugin.version')
+    def ccudPluginVersion = getInputParam('develocity.ccud-plugin.version')
+    def buildScanTermsOfUseUrl = getInputParam('develocity.terms-of-use.url')
+    def buildScanTermsOfUseAgree = getInputParam('develocity.terms-of-use.agree')
+    def ciAutoInjectionCustomValueValue = getInputParam('develocity.auto-injection.custom-value')
+
+    def atLeastGradle5 = GradleVersion.current() >= GradleVersion.version('5.0')
+    def atLeastGradle4 = GradleVersion.current() >= GradleVersion.version('4.0')
+    def shouldApplyDevelocityPlugin = atLeastGradle5 && develocityPluginVersion && isAtLeast(develocityPluginVersion, '3.17')
+
+    def dvOrGe = { def dvValue, def geValue ->
+        if (shouldApplyDevelocityPlugin) {
+            return dvValue instanceof Closure<?> ? dvValue() : dvValue
+        }
+        return geValue instanceof Closure<?> ? geValue() : geValue
+    }
+
+    // finish early if configuration parameters passed in via system properties are not valid/supported
+    if (ccudPluginVersion && isNotAtLeast(ccudPluginVersion, '1.7')) {
+        logger.warn("Common Custom User Data Gradle plugin must be at least 1.7. Configured version is $ccudPluginVersion.")
+        return
+    }
+
+    // Conditionally apply and configure the Develocity plugin
+    if (GradleVersion.current() < GradleVersion.version('6.0')) {
+        rootProject {
+            buildscript.configurations.getByName("classpath").incoming.afterResolve { ResolvableDependencies incoming ->
+                def resolutionResult = incoming.resolutionResult
+
+                if (develocityPluginVersion) {
+                    def scanPluginComponent = resolutionResult.allComponents.find {
+                        it.moduleVersion.with { group == "com.gradle" && ['build-scan-plugin', 'gradle-enterprise-gradle-plugin', 'develocity-gradle-plugin'].contains(name) }
+                    }
+                    if (!scanPluginComponent) {
+                        def pluginClass = dvOrGe(DEVELOCITY_PLUGIN_CLASS, BUILD_SCAN_PLUGIN_CLASS)
+                        logger.lifecycle("Applying $pluginClass via init script")
+                        applyPluginExternally(pluginManager, pluginClass)
+                        def rootExtension = dvOrGe(
+                            { develocity },
+                            { buildScan }
+                        )
+                        def buildScanExtension = dvOrGe(
+                            { rootExtension.buildScan },
+                            { rootExtension }
+                        )
+                        if (develocityUrl) {
+                            logger.lifecycle("Connection to Develocity: $develocityUrl, allowUntrustedServer: $develocityAllowUntrustedServer, captureFileFingerprints: $develocityCaptureFileFingerprints")
+                            rootExtension.server = develocityUrl
+                            rootExtension.allowUntrustedServer = develocityAllowUntrustedServer
+                        }
+                        if (!shouldApplyDevelocityPlugin) {
+                            // Develocity plugin publishes scans by default
+                            buildScanExtension.publishAlways()
+                        }
+                        // uploadInBackground not available for build-scan-plugin 1.16
+                        if (buildScanExtension.metaClass.respondsTo(buildScanExtension, 'setUploadInBackground', Boolean)) buildScanExtension.uploadInBackground = buildScanUploadInBackground
+                        buildScanExtension.value CI_AUTO_INJECTION_CUSTOM_VALUE_NAME, ciAutoInjectionCustomValueValue
+                        if (isAtLeast(develocityPluginVersion, '2.1') && atLeastGradle5) {
+                            logger.lifecycle("Setting captureFileFingerprints: $develocityCaptureFileFingerprints")
+                            if (isAtLeast(develocityPluginVersion, '3.17')) {
+                                buildScanExtension.capture.fileFingerprints.set(develocityCaptureFileFingerprints)
+                            } else if (isAtLeast(develocityPluginVersion, '3.7')) {
+                                buildScanExtension.capture.taskInputFiles = develocityCaptureFileFingerprints
+                            } else {
+                                buildScanExtension.captureTaskInputFiles = develocityCaptureFileFingerprints
+                            }
+                        }
+                    }
+
+                    if (develocityUrl && develocityEnforceUrl) {
+                        logger.lifecycle("Enforcing Develocity: $develocityUrl, allowUntrustedServer: $develocityAllowUntrustedServer, captureFileFingerprints: $develocityCaptureFileFingerprints")
+                    }
+
+                    pluginManager.withPlugin(BUILD_SCAN_PLUGIN_ID) {
+                        // Only execute if develocity plugin isn't applied.
+                        if (gradle.rootProject.extensions.findByName("develocity")) return
+                        afterEvaluate {
+                            if (develocityUrl && develocityEnforceUrl) {
+                                buildScan.server = develocityUrl
+                                buildScan.allowUntrustedServer = develocityAllowUntrustedServer
+                            }
+                        }
+
+                        if (buildScanTermsOfUseUrl && buildScanTermsOfUseAgree) {
+                            buildScan.termsOfServiceUrl = buildScanTermsOfUseUrl
+                            buildScan.termsOfServiceAgree = buildScanTermsOfUseAgree
+                        }
+                    }
+
+                    pluginManager.withPlugin(DEVELOCITY_PLUGIN_ID) {
+                        afterEvaluate {
+                            if (develocityUrl && develocityEnforceUrl) {
+                                develocity.server = develocityUrl
+                                develocity.allowUntrustedServer = develocityAllowUntrustedServer
+                            }
+                        }
+
+                        if (buildScanTermsOfUseUrl && buildScanTermsOfUseAgree) {
+                            develocity.buildScan.termsOfUseUrl = buildScanTermsOfUseUrl
+                            develocity.buildScan.termsOfUseAgree = buildScanTermsOfUseAgree
+                        }
+                    }
+                }
+
+                if (ccudPluginVersion && atLeastGradle4) {
+                    def ccudPluginComponent = resolutionResult.allComponents.find {
+                        it.moduleVersion.with { group == "com.gradle" && name == "common-custom-user-data-gradle-plugin" }
+                    }
+                    if (!ccudPluginComponent) {
+                        logger.lifecycle("Applying $CCUD_PLUGIN_CLASS via init script")
+                        pluginManager.apply(initscript.classLoader.loadClass(CCUD_PLUGIN_CLASS))
+                    }
+                }
+            }
+        }
+    } else {
+        gradle.settingsEvaluated { settings ->
+            if (develocityPluginVersion) {
+                if (!settings.pluginManager.hasPlugin(GRADLE_ENTERPRISE_PLUGIN_ID) && !settings.pluginManager.hasPlugin(DEVELOCITY_PLUGIN_ID)) {
+                    def pluginClass = dvOrGe(DEVELOCITY_PLUGIN_CLASS, GRADLE_ENTERPRISE_PLUGIN_CLASS)
+                    logger.lifecycle("Applying $pluginClass via init script")
+                    applyPluginExternally(settings.pluginManager, pluginClass)
+                    if (develocityUrl) {
+                        logger.lifecycle("Connection to Develocity: $develocityUrl, allowUntrustedServer: $develocityAllowUntrustedServer, captureFileFingerprints: $develocityCaptureFileFingerprints")
+                        eachDevelocitySettingsExtension(settings) { ext ->
+                            ext.server = develocityUrl
+                            ext.allowUntrustedServer = develocityAllowUntrustedServer
+                        }
+                    }
+
+                    eachDevelocitySettingsExtension(settings) { ext ->
+                        ext.buildScan.uploadInBackground = buildScanUploadInBackground
+                        ext.buildScan.value CI_AUTO_INJECTION_CUSTOM_VALUE_NAME, ciAutoInjectionCustomValueValue
+                    }
+
+                    eachDevelocitySettingsExtension(settings,
+                        { develocity ->
+                            logger.lifecycle("Setting captureFileFingerprints: $develocityCaptureFileFingerprints")
+                            develocity.buildScan.capture.fileFingerprints = develocityCaptureFileFingerprints
+                        },
+                        { gradleEnterprise ->
+                            gradleEnterprise.buildScan.publishAlways()
+                            if (isAtLeast(develocityPluginVersion, '2.1')) {
+                                logger.lifecycle("Setting captureFileFingerprints: $develocityCaptureFileFingerprints")
+                                if (isAtLeast(develocityPluginVersion, '3.7')) {
+                                    gradleEnterprise.buildScan.capture.taskInputFiles = develocityCaptureFileFingerprints
+                                } else {
+                                    gradleEnterprise.buildScan.captureTaskInputFiles = develocityCaptureFileFingerprints
+                                }
+                            }
+                        }
+                    )
+                }
+
+                if (develocityUrl && develocityEnforceUrl) {
+                    logger.lifecycle("Enforcing Develocity: $develocityUrl, allowUntrustedServer: $develocityAllowUntrustedServer, captureFileFingerprints: $develocityCaptureFileFingerprints")
+                }
+
+                eachDevelocitySettingsExtension(settings,
+                    { develocity ->
+                        if (develocityUrl && develocityEnforceUrl) {
+                            develocity.server = develocityUrl
+                            develocity.allowUntrustedServer = develocityAllowUntrustedServer
+                        }
+
+                        if (buildScanTermsOfUseUrl && buildScanTermsOfUseAgree) {
+                            develocity.buildScan.termsOfUseUrl = buildScanTermsOfUseUrl
+                            develocity.buildScan.termsOfUseAgree = buildScanTermsOfUseAgree
+                        }
+                    },
+                    { gradleEnterprise ->
+                        if (develocityUrl && develocityEnforceUrl) {
+                            gradleEnterprise.server = develocityUrl
+                            gradleEnterprise.allowUntrustedServer = develocityAllowUntrustedServer
+                        }
+
+                        if (buildScanTermsOfUseUrl && buildScanTermsOfUseAgree) {
+                            gradleEnterprise.buildScan.termsOfServiceUrl = buildScanTermsOfUseUrl
+                            gradleEnterprise.buildScan.termsOfServiceAgree = buildScanTermsOfUseAgree
+                        }
+                    }
+                )
+            }
+
+            if (ccudPluginVersion) {
+                if (!settings.pluginManager.hasPlugin(CCUD_PLUGIN_ID)) {
+                    logger.lifecycle("Applying $CCUD_PLUGIN_CLASS via init script")
+                    settings.pluginManager.apply(initscript.classLoader.loadClass(CCUD_PLUGIN_CLASS))
+                }
+            }
+        }
+    }
+}
+
+void applyPluginExternally(def pluginManager, String pluginClassName) {
+    def externallyApplied = 'develocity.externally-applied'
+    def externallyAppliedDeprecated = 'gradle.enterprise.externally-applied'
+    def oldValue = System.getProperty(externallyApplied)
+    def oldValueDeprecated = System.getProperty(externallyAppliedDeprecated)
+    System.setProperty(externallyApplied, 'true')
+    System.setProperty(externallyAppliedDeprecated, 'true')
+    try {
+        pluginManager.apply(initscript.classLoader.loadClass(pluginClassName))
+    } finally {
+        if (oldValue == null) {
+            System.clearProperty(externallyApplied)
+        } else {
+            System.setProperty(externallyApplied, oldValue)
+        }
+        if (oldValueDeprecated == null) {
+            System.clearProperty(externallyAppliedDeprecated)
+        } else {
+            System.setProperty(externallyAppliedDeprecated, oldValueDeprecated)
+        }
+    }
+}
+
+/**
+ * Apply the `dvAction` to all 'develocity' extensions.
+ * If no 'develocity' extensions are found, apply the `geAction` to all 'gradleEnterprise' extensions.
+ * (The develocity plugin creates both extensions, and we want to prefer configuring 'develocity').
+ */
+static def eachDevelocitySettingsExtension(def settings, def dvAction, def geAction = dvAction) {
+    def GRADLE_ENTERPRISE_EXTENSION_CLASS = 'com.gradle.enterprise.gradleplugin.GradleEnterpriseExtension'
+    def DEVELOCITY_CONFIGURATION_CLASS = 'com.gradle.develocity.agent.gradle.DevelocityConfiguration'
+
+    def dvExtensions = settings.extensions.extensionsSchema.elements
+        .findAll { it.publicType.concreteClass.name == DEVELOCITY_CONFIGURATION_CLASS }
+        .collect { settings[it.name] }
+    if (!dvExtensions.empty) {
+        dvExtensions.each(dvAction)
+    } else {
+        def geExtensions = settings.extensions.extensionsSchema.elements
+            .findAll { it.publicType.concreteClass.name == GRADLE_ENTERPRISE_EXTENSION_CLASS }
+            .collect { settings[it.name] }
+        geExtensions.each(geAction)
+    }
+}
+
+static boolean isAtLeast(String versionUnderTest, String referenceVersion) {
+    GradleVersion.version(versionUnderTest) >= GradleVersion.version(referenceVersion)
+}
+
+static boolean isNotAtLeast(String versionUnderTest, String referenceVersion) {
+    !isAtLeast(versionUnderTest, referenceVersion)
+}
+
+void enableBuildScanLinkCapture(BuildScanCollector collector) {
+    def BUILD_SCAN_PLUGIN_ID = 'com.gradle.build-scan'
+    def DEVELOCITY_PLUGIN_ID = 'com.gradle.develocity'
+
+    // Conditionally apply and configure the Develocity plugin
+    if (GradleVersion.current() < GradleVersion.version('6.0')) {
+        rootProject {
+            pluginManager.withPlugin(BUILD_SCAN_PLUGIN_ID) {
+                // Only execute if develocity plugin isn't applied.
+                if (gradle.rootProject.extensions.findByName("develocity")) return
+                buildScanPublishedAction(buildScan, collector)
+            }
+
+            pluginManager.withPlugin(DEVELOCITY_PLUGIN_ID) {
+                buildScanPublishedAction(develocity.buildScan, collector)
+            }
+        }
+    } else {
+        gradle.settingsEvaluated { settings ->
+            eachDevelocitySettingsExtension(settings) { ext ->
+                buildScanPublishedAction(ext.buildScan, collector)
+            }
+        }
+    }
+}
+
+// Action will only be called if a `BuildScanCollector.captureBuildScanLink` method is present.
+// Add `void captureBuildScanLink(String) {}` to the `BuildScanCollector` class to respond to buildScanPublished events
+static buildScanPublishedAction(def buildScanExtension, BuildScanCollector collector) {
+    if (buildScanExtension.metaClass.respondsTo(buildScanExtension, 'buildScanPublished', Action)) {
+        buildScanExtension.buildScanPublished { scan ->
+            collector.captureBuildScanLink(scan.buildScanUri.toString())
+        }
+    }
+}
+
+class BuildScanCollector {}

sources/src/setup-gradle.ts

@@ -0,0 +1,129 @@
+import * as core from '@actions/core'
+import * as exec from '@actions/exec'
+import * as fs from 'fs'
+import * as path from 'path'
+import * as os from 'os'
+import * as caches from './caching/caches'
+import * as jobSummary from './job-summary'
+import * as buildScan from './develocity/build-scan'
+
+import {loadBuildResults, markBuildResultsProcessed} from './build-results'
+import {CacheListener, generateCachingReport} from './caching/cache-reporting'
+import {DaemonController} from './daemon-controller'
+import {
+    BuildScanConfig,
+    CacheConfig,
+    SummaryConfig,
+    WrapperValidationConfig,
+    getWorkspaceDirectory
+} from './configuration'
+import * as wrapperValidator from './wrapper-validation/wrapper-validator'
+
+const GRADLE_SETUP_VAR = 'GRADLE_BUILD_ACTION_SETUP_COMPLETED'
+const USER_HOME = 'USER_HOME'
+const GRADLE_USER_HOME = 'GRADLE_USER_HOME'
+const CACHE_LISTENER = 'CACHE_LISTENER'
+
+export async function setup(
+    cacheConfig: CacheConfig,
+    buildScanConfig: BuildScanConfig,
+    wrapperValidationConfig: WrapperValidationConfig
+): Promise<boolean> {
+    const userHome = await determineUserHome()
+    const gradleUserHome = await determineGradleUserHome()
+
+    // Bypass setup on all but first action step in workflow.
+    if (process.env[GRADLE_SETUP_VAR]) {
+        core.info('Gradle setup only performed on first gradle/actions step in workflow.')
+        return false
+    }
+    // Record setup complete: visible to all subsequent actions and prevents duplicate setup
+    core.exportVariable(GRADLE_SETUP_VAR, true)
+    // Record setup complete: visible in post-action, to control action completion
+    core.saveState(GRADLE_SETUP_VAR, true)
+
+    // Save the User Home and Gradle User Home for use in the post-action step.
+    core.saveState(USER_HOME, userHome)
+    core.saveState(GRADLE_USER_HOME, gradleUserHome)
+
+    const cacheListener = new CacheListener()
+    await caches.restore(userHome, gradleUserHome, cacheListener, cacheConfig)
+
+    core.saveState(CACHE_LISTENER, cacheListener.stringify())
+
+    await wrapperValidator.validateWrappers(wrapperValidationConfig, getWorkspaceDirectory(), gradleUserHome)
+
+    await buildScan.setup(buildScanConfig)
+
+    return true
+}
+
+export async function complete(cacheConfig: CacheConfig, summaryConfig: SummaryConfig): Promise<boolean> {
+    if (!core.getState(GRADLE_SETUP_VAR)) {
+        core.info('Gradle setup post-action only performed for first gradle/actions step in workflow.')
+        return false
+    }
+    core.info('In post-action step')
+
+    const buildResults = loadBuildResults()
+
+    const userHome = core.getState(USER_HOME)
+    const gradleUserHome = core.getState(GRADLE_USER_HOME)
+    const cacheListener: CacheListener = CacheListener.rehydrate(core.getState(CACHE_LISTENER))
+
+    const daemonController = new DaemonController(buildResults)
+    await caches.save(userHome, gradleUserHome, cacheListener, daemonController, buildResults, cacheConfig)
+
+    const cachingReport = generateCachingReport(cacheListener)
+    await jobSummary.generateJobSummary(buildResults, cachingReport, summaryConfig)
+
+    markBuildResultsProcessed()
+
+    core.info('Completed post-action step')
+
+    return true
+}
+
+async function determineGradleUserHome(): Promise<string> {
+    const customGradleUserHome = process.env['GRADLE_USER_HOME']
+    if (customGradleUserHome) {
+        const rootDir = getWorkspaceDirectory()
+        return path.resolve(rootDir, customGradleUserHome)
+    }
+
+    const defaultGradleUserHome = path.resolve(await determineUserHome(), '.gradle')
+    // Use the default Gradle User Home if it already exists
+    if (fs.existsSync(defaultGradleUserHome)) {
+        core.info(`Gradle User Home already exists at ${defaultGradleUserHome}`)
+        core.exportVariable('GRADLE_USER_HOME', defaultGradleUserHome)
+        return defaultGradleUserHome
+    }
+
+    // Switch Gradle User Home to faster 'D:' drive if possible
+    if (os.platform() === 'win32' && defaultGradleUserHome.startsWith('C:\\') && fs.existsSync('D:\\a\\')) {
+        const fasterGradleUserHome = 'D:\\a\\.gradle'
+        core.info(`Setting GRADLE_USER_HOME to ${fasterGradleUserHome} to leverage (potentially) faster drive.`)
+        core.exportVariable('GRADLE_USER_HOME', fasterGradleUserHome)
+        return fasterGradleUserHome
+    }
+
+    core.exportVariable('GRADLE_USER_HOME', defaultGradleUserHome)
+    return defaultGradleUserHome
+}
+
+/**
+ * Different values can be returned by os.homedir() in Javascript and System.getProperty('user.home') in Java.
+ * In order to determine the correct Gradle User Home, we ask Java for the user home instead of using os.homedir().
+ */
+async function determineUserHome(): Promise<string> {
+    const output = await exec.getExecOutput('java', ['-XshowSettings:properties', '-version'], {silent: true})
+    const regex = /user\.home = (\S*)/i
+    const found = output.stderr.match(regex)
+    if (found == null || found.length <= 1) {
+        core.info('Could not determine user.home from java -version output. Using os.homedir().')
+        return os.homedir()
+    }
+    const userHome = found[1]
+    core.debug(`Determined user.home from java -version output: '${userHome}'`)
+    return userHome
+}

sources/src/wrapper-validation/cache.ts

@@ -0,0 +1,26 @@
+import fs from 'fs'
+import path from 'path'
+import {ACTION_METADATA_DIR} from '../configuration'
+
+export class ChecksumCache {
+    private readonly cacheFile: string
+
+    constructor(gradleUserHome: string) {
+        this.cacheFile = path.resolve(gradleUserHome, ACTION_METADATA_DIR, 'valid-wrappers.json')
+    }
+
+    load(): string[] {
+        // Load previously validated checksums saved in Gradle User Home
+        if (fs.existsSync(this.cacheFile)) {
+            return JSON.parse(fs.readFileSync(this.cacheFile, 'utf-8'))
+        }
+        return []
+    }
+
+    save(checksums: string[]): void {
+        const uniqueChecksums = [...new Set(checksums)]
+        // Save validated checksums to Gradle User Home
+        fs.mkdirSync(path.dirname(this.cacheFile), {recursive: true})
+        fs.writeFileSync(this.cacheFile, JSON.stringify(uniqueChecksums))
+    }
+}

sources/src/wrapper-validation/checksums.ts

@@ -0,0 +1,96 @@
+import * as httpm from 'typed-rest-client/HttpClient'
+import * as cheerio from 'cheerio'
+
+import fileWrapperChecksums from './wrapper-checksums.json'
+
+const httpc = new httpm.HttpClient('gradle/wrapper-validation-action', undefined, {allowRetries: true, maxRetries: 3})
+
+export class WrapperChecksums {
+    checksums = new Map<string, Set<string>>()
+    versions = new Set<string>()
+
+    add(version: string, checksum: string): void {
+        if (this.checksums.has(checksum)) {
+            this.checksums.get(checksum)!.add(version)
+        } else {
+            this.checksums.set(checksum, new Set([version]))
+        }
+
+        this.versions.add(version)
+    }
+}
+
+function loadKnownChecksums(): WrapperChecksums {
+    const checksums = new WrapperChecksums()
+    for (const entry of fileWrapperChecksums) {
+        checksums.add(entry.version, entry.checksum)
+    }
+    return checksums
+}
+
+/**
+ * Known checksums from previously published Wrapper versions.
+ *
+ * Maps from the checksum to the names of the Gradle versions whose wrapper has this checksum.
+ */
+export const KNOWN_CHECKSUMS = loadKnownChecksums()
+
+export async function fetchUnknownChecksums(
+    allowSnapshots: boolean,
+    knownChecksums: WrapperChecksums
+): Promise<Set<string>> {
+    const all = await httpGetJsonArray('https://services.gradle.org/versions/all')
+    const withChecksum = all.filter(
+        entry => typeof entry === 'object' && entry != null && entry.hasOwnProperty('wrapperChecksumUrl')
+    )
+    const allowed = withChecksum.filter(
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (entry: any) => allowSnapshots || !entry.snapshot
+    )
+    const notKnown = allowed.filter(
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (entry: any) => !knownChecksums.versions.has(entry.version)
+    )
+    const checksumUrls = notKnown.map(
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (entry: any) => entry.wrapperChecksumUrl as string
+    )
+    if (allowSnapshots) {
+        await addDistributionSnapshotChecksums(checksumUrls)
+    }
+    const checksums = await Promise.all(
+        checksumUrls.map(async (url: string) => {
+            // console.log(`Fetching checksum from ${url}`)
+            return httpGetText(url)
+        })
+    )
+    return new Set(checksums)
+}
+
+async function httpGetJsonArray(url: string): Promise<unknown[]> {
+    return JSON.parse(await httpGetText(url))
+}
+
+async function httpGetText(url: string): Promise<string> {
+    const response = await httpc.get(url)
+    return await response.readBody()
+}
+
+// Public for testing
+export async function addDistributionSnapshotChecksums(checksumUrls: string[]): Promise<void> {
+    // Load the index page of the distribution snapshot repository
+    const indexPage = await httpGetText('https://services.gradle.org/distributions-snapshots/')
+
+    // // Extract all wrapper checksum from the index page. These end in -wrapper.jar.sha256
+    // // Load the HTML into cheerio
+    const $ = cheerio.load(indexPage)
+
+    // // Find all links ending with '-wrapper.jar.sha256'
+    const wrapperChecksumLinks = $('a[href$="-wrapper.jar.sha256"]')
+
+    // build the absolute URL for each wrapper checksum
+    wrapperChecksumLinks.each((index, element) => {
+        const url = $(element).attr('href')
+        checksumUrls.push(`https://services.gradle.org${url}`)
+    })
+}

sources/src/wrapper-validation/find.ts

@@ -0,0 +1,27 @@
+import * as util from 'util'
+import * as path from 'path'
+import * as fs from 'fs'
+import unhomoglyph from 'unhomoglyph'
+
+const readdir = util.promisify(fs.readdir)
+
+export async function findWrapperJars(baseDir: string): Promise<string[]> {
+    const files = await recursivelyListFiles(baseDir)
+    return files
+        .filter(file => unhomoglyph(file).endsWith('gradle-wrapper.jar'))
+        .map(wrapperJar => path.relative(baseDir, wrapperJar))
+        .sort((a, b) => a.localeCompare(b))
+}
+
+async function recursivelyListFiles(baseDir: string): Promise<string[]> {
+    const childrenNames = await readdir(baseDir)
+    const childrenPaths = await Promise.all(
+        childrenNames.map(async childName => {
+            const childPath = path.resolve(baseDir, childName)
+            return fs.lstatSync(childPath).isDirectory()
+                ? recursivelyListFiles(childPath)
+                : new Promise(resolve => resolve([childPath]))
+        })
+    )
+    return Array.prototype.concat(...childrenPaths)
+}

sources/src/wrapper-validation/hash.ts

@@ -0,0 +1,18 @@
+import * as crypto from 'crypto'
+import * as fs from 'fs'
+
+export async function sha256File(path: string): Promise<string> {
+    return new Promise((resolve, reject) => {
+        const hash = crypto.createHash('sha256')
+        const stream = fs.createReadStream(path)
+        stream.on('data', data => hash.update(data))
+        stream.on('end', () => {
+            stream.destroy()
+            resolve(hash.digest('hex'))
+        })
+        stream.on('error', error => {
+            stream.destroy()
+            reject(error)
+        })
+    })
+}

sources/src/wrapper-validation/validate.ts

@@ -0,0 +1,92 @@
+import * as find from './find'
+import * as checksums from './checksums'
+import * as hash from './hash'
+import {resolve} from 'path'
+
+export async function findInvalidWrapperJars(
+    gitRepoRoot: string,
+    allowSnapshots: boolean,
+    allowedChecksums: string[],
+    previouslyValidatedChecksums: string[] = [],
+    knownValidChecksums: checksums.WrapperChecksums = checksums.KNOWN_CHECKSUMS
+): Promise<ValidationResult> {
+    const wrapperJars = await find.findWrapperJars(gitRepoRoot)
+    const result = new ValidationResult([], [])
+    if (wrapperJars.length > 0) {
+        const notYetValidatedWrappers = []
+        for (const wrapperJar of wrapperJars) {
+            const sha = await hash.sha256File(resolve(gitRepoRoot, wrapperJar))
+            if (
+                allowedChecksums.includes(sha) ||
+                previouslyValidatedChecksums.includes(sha) ||
+                knownValidChecksums.checksums.has(sha)
+            ) {
+                result.valid.push(new WrapperJar(wrapperJar, sha))
+            } else {
+                notYetValidatedWrappers.push(new WrapperJar(wrapperJar, sha))
+            }
+        }
+
+        // Otherwise fall back to fetching checksums from Gradle API and compare against them
+        if (notYetValidatedWrappers.length > 0) {
+            result.fetchedChecksums = true
+            const fetchedValidChecksums = await checksums.fetchUnknownChecksums(allowSnapshots, knownValidChecksums)
+
+            for (const wrapperJar of notYetValidatedWrappers) {
+                if (!fetchedValidChecksums.has(wrapperJar.checksum)) {
+                    result.invalid.push(wrapperJar)
+                } else {
+                    result.valid.push(wrapperJar)
+                }
+            }
+        }
+    }
+    return result
+}
+
+export class ValidationResult {
+    valid: WrapperJar[]
+    invalid: WrapperJar[]
+    fetchedChecksums = false
+
+    constructor(valid: WrapperJar[], invalid: WrapperJar[]) {
+        this.valid = valid
+        this.invalid = invalid
+    }
+
+    isValid(): boolean {
+        return this.invalid.length === 0
+    }
+
+    toDisplayString(): string {
+        let displayString = ''
+        if (this.invalid.length > 0) {
+            displayString += `✗ Found unknown Gradle Wrapper JAR files:\n${ValidationResult.toDisplayList(
+                this.invalid
+            )}`
+        }
+        if (this.valid.length > 0) {
+            if (displayString.length > 0) displayString += '\n'
+            displayString += `✓ Found known Gradle Wrapper JAR files:\n${ValidationResult.toDisplayList(this.valid)}`
+        }
+        return displayString
+    }
+
+    private static toDisplayList(wrapperJars: WrapperJar[]): string {
+        return `  ${wrapperJars.map(wj => wj.toDisplayString()).join(`\n  `)}`
+    }
+}
+
+export class WrapperJar {
+    path: string
+    checksum: string
+
+    constructor(path: string, checksum: string) {
+        this.path = path
+        this.checksum = checksum
+    }
+
+    toDisplayString(): string {
+        return `${this.checksum} ${this.path}`
+    }
+}

sources/src/wrapper-validation/wrapper-validator.ts

@@ -0,0 +1,40 @@
+import * as core from '@actions/core'
+
+import {WrapperValidationConfig} from '../configuration'
+import {ChecksumCache} from './cache'
+import {findInvalidWrapperJars} from './validate'
+import {JobFailure} from '../errors'
+
+export async function validateWrappers(
+    config: WrapperValidationConfig,
+    workspaceRoot: string,
+    gradleUserHome: string
+): Promise<void> {
+    if (!config.doValidateWrappers()) {
+        return // Wrapper validation is disabled
+    }
+    const checksumCache = new ChecksumCache(gradleUserHome)
+
+    const allowedChecksums = process.env['ALLOWED_GRADLE_WRAPPER_CHECKSUMS']?.split(',') || []
+    const previouslyValidatedChecksums = checksumCache.load()
+
+    const result = await findInvalidWrapperJars(
+        workspaceRoot,
+        config.allowSnapshotWrappers(),
+        allowedChecksums,
+        previouslyValidatedChecksums
+    )
+    if (result.isValid()) {
+        await core.group('All Gradle Wrapper jars are valid', async () => {
+            core.debug(`Loaded previously validated checksums from cache: ${previouslyValidatedChecksums.join(', ')}`)
+            core.info(result.toDisplayString())
+        })
+    } else {
+        core.info(result.toDisplayString())
+        throw new JobFailure(
+            `At least one Gradle Wrapper Jar failed validation!\n  See https://github.com/gradle/actions/blob/main/docs/wrapper-validation.md#validation-failures\n${result.toDisplayString()}`
+        )
+    }
+
+    checksumCache.save(result.valid.map(wrapper => wrapper.checksum))
+}

sources/test/init-scripts/.gitignore

@@ -0,0 +1,2 @@
+build
+.gradle

sources/test/init-scripts/build.gradle

@@ -0,0 +1,28 @@
+plugins {
+    id 'groovy'
+}
+
+java {
+    toolchain {
+        languageVersion = JavaLanguageVersion.of(8)
+    }
+}
+
+repositories {
+    mavenCentral()
+}
+
+dependencies {
+    testImplementation gradleTestKit()
+    testImplementation 'org.spockframework:spock-core:2.3-groovy-3.0'
+    testImplementation('org.spockframework:spock-junit4:2.3-groovy-3.0')
+
+    testImplementation ('io.ratpack:ratpack-groovy-test:1.9.0') {
+        exclude group: 'org.codehaus.groovy', module: 'groovy-all'
+    }
+    testImplementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile:2.17.2'
+}
+
+test {
+    useJUnitPlatform()
+}

sources/test/init-scripts/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,8 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionSha256Sum=5b9c5eb3f9fc2c94abaea57d90bd78747ca117ddbbf96c859d3741181a12bf2a
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.10-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists

sources/test/init-scripts/gradlew

@@ -0,0 +1,252 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s
+' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"

sources/test/init-scripts/gradlew.bat

@@ -0,0 +1,94 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

sources/test/init-scripts/settings.gradle

@@ -0,0 +1,13 @@
+plugins {
+    id "com.gradle.develocity" version "3.18.1"
+    id "com.gradle.common-custom-user-data-gradle-plugin" version "2.0.1"
+}
+
+develocity {
+    buildScan {
+        termsOfUseUrl = "https://gradle.com/help/legal-terms-of-use"
+        termsOfUseAgree = "yes"
+        uploadInBackground = false
+    }
+}
+rootProject.name = 'test-init-scripts'

sources/test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/BaseInitScriptTest.groovy

@@ -0,0 +1,286 @@
+package com.gradle.gradlebuildaction
+
+import com.fasterxml.jackson.core.JsonFactory
+import com.fasterxml.jackson.databind.ObjectMapper
+import com.fasterxml.jackson.dataformat.smile.SmileFactory
+import org.gradle.testkit.runner.BuildResult
+import org.gradle.testkit.runner.GradleRunner
+import org.gradle.testkit.runner.internal.DefaultGradleRunner
+import org.gradle.util.GradleVersion
+import ratpack.groovy.test.embed.GroovyEmbeddedApp
+import spock.lang.AutoCleanup
+import spock.lang.Specification
+import spock.lang.TempDir
+
+import java.nio.file.Files
+import java.util.zip.GZIPOutputStream
+
+class BaseInitScriptTest extends Specification {
+    static final String DEVELOCITY_PLUGIN_VERSION = '3.18.1'
+    static final String CCUD_PLUGIN_VERSION = '2.0.1'
+
+    static final TestGradleVersion GRADLE_3_X = new TestGradleVersion(GradleVersion.version('3.5.1'), 7, 9)
+    static final TestGradleVersion GRADLE_4_X = new TestGradleVersion(GradleVersion.version('4.10.3'), 7, 10)
+    static final TestGradleVersion GRADLE_5_X = new TestGradleVersion(GradleVersion.version('5.6.4'), 8, 12)
+    static final TestGradleVersion GRADLE_6_0 = new TestGradleVersion(GradleVersion.version('6.0.1'), 8, 13)
+    static final TestGradleVersion GRADLE_6_NO_BUILD_SERVICE = new TestGradleVersion(GradleVersion.version('6.5.1'), 8, 14)
+    static final TestGradleVersion GRADLE_6_X = new TestGradleVersion(GradleVersion.version('6.9.4'), 8, 15)
+    static final TestGradleVersion GRADLE_7_1 = new TestGradleVersion(GradleVersion.version('7.1.1'), 8, 16)
+    static final TestGradleVersion GRADLE_7_X = new TestGradleVersion(GradleVersion.version('7.6.2'), 8, 19)
+    static final TestGradleVersion GRADLE_8_0 = new TestGradleVersion(GradleVersion.version('8.0.2'), 8, 19)
+    static final TestGradleVersion GRADLE_8_X = new TestGradleVersion(GradleVersion.version('8.10'), 8, 23)
+
+    static final List<TestGradleVersion> ALL_VERSIONS = [
+        GRADLE_3_X, // First version where TestKit supports environment variables
+        GRADLE_4_X,
+        GRADLE_5_X,
+        GRADLE_6_0,
+        GRADLE_6_NO_BUILD_SERVICE, // Last version without build service support
+        GRADLE_6_X,
+        GRADLE_7_1,
+        GRADLE_7_X,
+        GRADLE_8_0,
+        GRADLE_8_X,
+    ]
+
+    static final List<TestGradleVersion> CONFIGURATION_CACHE_VERSIONS =
+        [GRADLE_7_X, GRADLE_8_0, GRADLE_8_X]
+
+    static final List<TestGradleVersion> SETTINGS_PLUGIN_VERSIONS =
+        [GRADLE_6_X, GRADLE_7_1, GRADLE_7_X, GRADLE_8_0, GRADLE_8_X]
+
+    static final String PUBLIC_BUILD_SCAN_ID = 'i2wepy2gr7ovw'
+    static final String DEFAULT_SCAN_UPLOAD_TOKEN = 'scan-upload-token'
+    static final String ROOT_PROJECT_NAME = 'test-init-script'
+    boolean failScanUpload = false
+
+    File settingsFile
+    File buildFile
+
+    boolean allowDevelocityDeprecationWarning = false
+
+    @TempDir
+    File testProjectDir
+
+    @AutoCleanup
+    def mockScansServer = GroovyEmbeddedApp.of {
+        def jsonWriter = new ObjectMapper(new JsonFactory()).writer()
+        def smileWriter = new ObjectMapper(new SmileFactory()).writer()
+
+        handlers {
+            post('in/:gradleVersion/:pluginVersion') {
+                if (failScanUpload) {
+                    context.response.status(401).send()
+                    return
+                }
+                def scanUrlString = "${mockScansServer.address}s/$PUBLIC_BUILD_SCAN_ID"
+                def body = [
+                    id     : PUBLIC_BUILD_SCAN_ID,
+                    scanUrl: scanUrlString.toString(),
+                ]
+                def out = new ByteArrayOutputStream()
+                new GZIPOutputStream(out).withStream { smileWriter.writeValue(it, body) }
+                context.response
+                    .contentType('application/vnd.gradle.scan-ack')
+                    .send(out.toByteArray())
+            }
+            prefix('scans/publish') {
+                post('gradle/:pluginVersion/token') {
+                    if (failScanUpload) {
+                        context.response.status(401).send()
+                        return
+                    }
+                    def pluginVersion = context.pathTokens.pluginVersion
+                    def scanUrlString = "${mockScansServer.address}s/$PUBLIC_BUILD_SCAN_ID"
+                    def body = [
+                        id             : PUBLIC_BUILD_SCAN_ID,
+                        scanUrl        : scanUrlString.toString(),
+                        scanUploadUrl  : "${mockScansServer.address.toString()}scans/publish/gradle/$pluginVersion/upload".toString(),
+                        scanUploadToken: DEFAULT_SCAN_UPLOAD_TOKEN
+                    ]
+                    context.response
+                        .contentType('application/vnd.gradle.scan-ack+json')
+                        .send(jsonWriter.writeValueAsBytes(body))
+                }
+                post('gradle/:pluginVersion/upload') {
+                    if (failScanUpload) {
+                        context.response.status(401).send()
+                        return
+                    }
+                    context.request.getBody(1024 * 1024 * 10).then {
+                        context.response
+                            .contentType('application/vnd.gradle.scan-upload-ack+json')
+                            .send()
+                    }
+                }
+                notFound()
+            }
+        }
+    }
+
+    def setup() {
+        settingsFile = new File(testProjectDir, 'settings.gradle')
+        buildFile = new File(testProjectDir, 'build.gradle')
+
+        File srcInitScriptsDir = new File("../../src/resources/init-scripts")
+        File targetInitScriptsDir = new File(testProjectDir, "initScripts")
+        targetInitScriptsDir.mkdirs()
+
+        for (File srcInitScript : srcInitScriptsDir.listFiles()) {
+            File targetInitScript = new File(targetInitScriptsDir, srcInitScript.name)
+            Files.copy(srcInitScript.toPath(), targetInitScript.toPath())
+        }
+        settingsFile << "rootProject.name = '${ROOT_PROJECT_NAME}'\n"
+        buildFile << ''
+    }
+
+    def declareDevelocityPluginApplication(GradleVersion gradleVersion, URI serverUrl = mockScansServer.address) {
+        settingsFile.text = maybeAddPluginsToSettings(gradleVersion, false, null, serverUrl) + settingsFile.text
+        buildFile.text = maybeAddPluginsToRootProject(gradleVersion, false, null, serverUrl) + buildFile.text
+    }
+
+    def declareLegacyGradleEnterprisePluginApplication(GradleVersion gradleVersion, URI serverUrl = mockScansServer.address) {
+        settingsFile.text = maybeAddPluginsToSettings(gradleVersion, true, null, serverUrl) + settingsFile.text
+        buildFile.text = maybeAddPluginsToRootProject(gradleVersion, true, null, serverUrl) + buildFile.text
+    }
+
+    def declareDevelocityPluginAndCcudPluginApplication(GradleVersion gradleVersion, URI serverUrl = mockScansServer.address) {
+        settingsFile.text = maybeAddPluginsToSettings(gradleVersion, false, CCUD_PLUGIN_VERSION, serverUrl) + settingsFile.text
+        buildFile.text = maybeAddPluginsToRootProject(gradleVersion, false, CCUD_PLUGIN_VERSION, serverUrl) + buildFile.text
+    }
+
+    String maybeAddPluginsToSettings(GradleVersion gradleVersion, boolean legacy, String ccudPluginVersion, URI serverUri) {
+        if (gradleVersion < GradleVersion.version('6.0')) {
+            '' // applied in build.gradle
+        } else {
+            configuredPlugin(gradleVersion, legacy, ccudPluginVersion, serverUri)
+        }
+    }
+
+    String maybeAddPluginsToRootProject(GradleVersion gradleVersion, boolean legacy, String ccudPluginVersion, URI serverUrl) {
+        if (gradleVersion < GradleVersion.version('5.0')) {
+            """
+              plugins {
+                id 'com.gradle.build-scan' version '1.16'
+                ${ccudPluginVersion ? "id 'com.gradle.common-custom-user-data-gradle-plugin' version '$ccudPluginVersion'" : ""}
+              }
+              buildScan {
+                server = '$serverUrl'
+                publishAlways()
+              }
+            """
+        } else if (gradleVersion < GradleVersion.version('6.0')) {
+            configuredPlugin(gradleVersion, legacy, ccudPluginVersion, serverUrl)
+        } else {
+            '' // applied in settings.gradle
+        }
+    }
+
+    String configuredPlugin(GradleVersion gradleVersion, boolean legacy, String ccudPluginVersion, URI serverUri) {
+        def pluginId = legacy
+            ? (gradleVersion < GradleVersion.version('6.0') ? 'com.gradle.build-scan' : 'com.gradle.enterprise')
+            : 'com.gradle.develocity'
+        def pluginVersion = legacy ? "3.16.2" : DEVELOCITY_PLUGIN_VERSION
+        def configBlock = legacy ? 'gradleEnterprise' : 'develocity'
+        """
+              plugins {
+                id '$pluginId' version '$pluginVersion'
+                ${ccudPluginVersion ? "id 'com.gradle.common-custom-user-data-gradle-plugin' version '$ccudPluginVersion'" : ""}
+              }
+              $configBlock {
+                 server = '$serverUri'
+                 ${legacy ? "buildScan { publishAlways() }" : ""}
+              }
+            """
+    }
+
+    def addFailingTaskToBuild() {
+        buildFile << '''
+task expectFailure {
+    doLast {
+        throw new RuntimeException("Expected to fail")
+    }
+}
+'''
+    }
+
+    BuildResult run(List<String> args, String initScript, GradleVersion gradleVersion = GradleVersion.current(), List<String> jvmArgs = [], Map<String, String> envVars = [:]) {
+        def result = createRunner(args, initScript, gradleVersion, jvmArgs, envVars).build()
+        assertNoDeprecationWarning(result)
+    }
+
+    BuildResult runAndFail(List<String> args, String initScript, GradleVersion gradleVersion = GradleVersion.current(), List<String> jvmArgs = [], Map<String, String> envVars = [:]) {
+        def result = createRunner(args, initScript, gradleVersion, jvmArgs, envVars).buildAndFail()
+        assertNoDeprecationWarning(result)
+    }
+
+    GradleRunner createRunner(List<String> args, String initScript, GradleVersion gradleVersion = GradleVersion.current(), List<String> jvmArgs = [], Map<String, String> envVars = [:]) {
+        File initScriptsDir = new File(testProjectDir, "initScripts")
+        args << '-I' << new File(initScriptsDir, initScript).absolutePath
+
+        def runner = ((DefaultGradleRunner) GradleRunner.create())
+            .withGradleVersion(gradleVersion.version)
+            .withProjectDir(testProjectDir)
+            .withArguments(args)
+            .forwardOutput()
+
+        if (testKitSupportsEnvVars(gradleVersion)) {
+            runner.withEnvironment(envVars)
+        } else {
+            (runner as DefaultGradleRunner).withJvmArguments(jvmArgs)
+        }
+
+        runner
+    }
+
+    private boolean testKitSupportsEnvVars(GradleVersion gradleVersion) {
+        // TestKit supports env vars for Gradle 3.5+, except on M1 Mac where only 6.9+ is supported
+        def isM1Mac = System.getProperty("os.arch") == "aarch64"
+        if (isM1Mac) {
+            return gradleVersion >= GRADLE_6_X.gradleVersion
+        } else {
+            return gradleVersion >= GRADLE_3_X.gradleVersion
+        }
+    }
+
+    BuildResult assertNoDeprecationWarning(BuildResult result) {
+        if (!allowDevelocityDeprecationWarning) {
+            assert !result.output.contains("WARNING: The following functionality has been deprecated")
+        }
+        return result
+    }
+
+    static final class TestGradleVersion {
+
+        final GradleVersion gradleVersion
+        private final Integer jdkMin
+        private final Integer jdkMax
+
+        TestGradleVersion(GradleVersion gradleVersion, Integer jdkMin, Integer jdkMax) {
+            this.gradleVersion = gradleVersion
+            this.jdkMin = jdkMin
+            this.jdkMax = jdkMax
+        }
+
+        boolean isCompatibleWithCurrentJvm() {
+            def jvmVersion = getJvmVersion()
+            jdkMin <= jvmVersion && jvmVersion <= jdkMax
+        }
+
+        private static int getJvmVersion() {
+            String version = System.getProperty('java.version')
+            if (version.startsWith('1.')) {
+                Integer.parseInt(version.substring(2, 3))
+            } else {
+                Integer.parseInt(version.substring(0, version.indexOf('.')))
+            }
+        }
+
+        @Override
+        String toString() {
+            return "Gradle " + gradleVersion.version
+        }
+
+    }
+
+}

sources/test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/TestBuildResultRecorder.groovy

@@ -0,0 +1,278 @@
+package com.gradle.gradlebuildaction
+
+import groovy.json.JsonSlurper
+
+import static org.junit.Assume.assumeTrue
+
+class TestBuildResultRecorder extends BaseInitScriptTest {
+    def initScript = 'gradle-actions.build-result-capture.init.gradle'
+
+    def "produces build results file for build with #testGradleVersion"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        run(testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('help', testGradleVersion, false)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "produces build results file for failing build with #testGradleVersion"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        addFailingTaskToBuild()
+        runAndFail(testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('expectFailure', testGradleVersion, true)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "produces build results file for build with --configuration-cache on #testGradleVersion"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        run(['help', '--configuration-cache'], testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('help', testGradleVersion, false, false)
+        assert buildResultFile.delete()
+
+        when:
+        run(['help', '--configuration-cache'], testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('help', testGradleVersion, false, true)
+
+        where:
+        testGradleVersion << CONFIGURATION_CACHE_VERSIONS
+    }
+
+    def "produces build results file for #testGradleVersion with build scan published"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        declareDevelocityPluginApplication(testGradleVersion.gradleVersion)
+        run(testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('help', testGradleVersion, false)
+        assertScanResults()
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "produces build results file for #testGradleVersion with legacy enterprise plugin publishing build scan"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        declareLegacyGradleEnterprisePluginApplication(testGradleVersion.gradleVersion)
+        run(testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('help', testGradleVersion, false)
+        assertScanResults()
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "produces build results file for #testGradleVersion with Develocity plugin and no build scan published"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        declareDevelocityPluginApplication(testGradleVersion.gradleVersion)
+        run(['help', '--no-scan'], testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('help', testGradleVersion, false)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "produces build results file for failing build on #testGradleVersion with build scan published"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        declareDevelocityPluginApplication(testGradleVersion.gradleVersion)
+        addFailingTaskToBuild()
+        runAndFail(testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('expectFailure', testGradleVersion, true)
+        assertScanResults()
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "produces build results file for build with --configuration-cache on #testGradleVersion with build scan published"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        declareDevelocityPluginApplication(testGradleVersion.gradleVersion)
+        run(['help', '--configuration-cache'], testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('help', testGradleVersion, false, false)
+        assertScanResults()
+        assert buildResultFile.delete()
+        assert scanResultFile.delete()
+
+        when:
+        run(['help', '--configuration-cache'], testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('help', testGradleVersion, false, true)
+        assertScanResults()
+
+        where:
+        testGradleVersion << CONFIGURATION_CACHE_VERSIONS
+    }
+
+    def "produces build results file for failing build on #testGradleVersion when build scan publish fails"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        declareDevelocityPluginApplication(testGradleVersion.gradleVersion)
+        addFailingTaskToBuild()
+        failScanUpload = true
+        runAndFail(testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('expectFailure', testGradleVersion, true)
+        assertScanResults(true)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "produces no build results file when GitHub env vars not set with #testGradleVersion"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        run(['help'], initScript, testGradleVersion.gradleVersion,
+            ["-DRUNNER_TEMP=", "-DGITHUB_ACTION="],
+            [RUNNER_TEMP: '', GITHUB_ACTION: ''])
+
+        then:
+        def buildResultsDir = new File(testProjectDir, '.build-results')
+        assert !buildResultsDir.exists()
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "produces no build results file when RUNNER_TEMP dir is not a writable directory with #testGradleVersion"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def invalidDir = new File(testProjectDir, 'invalid-runner-temp')
+        invalidDir.createNewFile()
+
+        run(['help'], initScript, testGradleVersion.gradleVersion,
+            ["-DRUNNER_TEMP=${invalidDir.absolutePath}".toString()],
+            [RUNNER_TEMP: invalidDir.absolutePath])
+
+        then:
+        def buildResultsDir = new File(testProjectDir, '.build-results')
+        assert !buildResultsDir.exists()
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "produces build results file with build scan when Develocity plugin is applied in settingsEvaluated"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        settingsFile.text = """
+            plugins {
+                id 'com.gradle.develocity' version '3.18.1' apply(false)
+            }
+            gradle.settingsEvaluated {
+                apply plugin: 'com.gradle.develocity'
+                develocity {
+                    server = '$mockScansServer.address'
+                }
+            }
+        """ + settingsFile.text
+
+        allowDevelocityDeprecationWarning = true
+        run(testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('help', testGradleVersion, false)
+        assertScanResults()
+
+        where:
+        testGradleVersion << SETTINGS_PLUGIN_VERSIONS
+    }
+
+    def run(def args = ['help'], def gradleVersion) {
+        return run(args, initScript, gradleVersion, jvmArgs, envVars)
+    }
+
+    def runAndFail(def gradleVersion) {
+        return runAndFail(['expectFailure'], initScript, gradleVersion, jvmArgs, envVars)
+    }
+
+    def getJvmArgs() {
+        [
+            "-DRUNNER_TEMP=${testProjectDir.absolutePath}".toString(),
+            "-DGITHUB_ACTION=github-step-id".toString()
+        ]
+    }
+
+    def getEnvVars() {
+        [
+            RUNNER_TEMP: testProjectDir.absolutePath,
+            GITHUB_ACTION: 'github-step-id'
+        ]
+    }
+
+    void assertResults(String task, TestGradleVersion testGradleVersion, boolean hasFailure, boolean configCacheHit = false) {
+        def results = new JsonSlurper().parse(buildResultFile)
+        assert results['rootProjectName'] == ROOT_PROJECT_NAME
+        assert results['rootProjectDir'] == testProjectDir.canonicalPath
+        assert results['requestedTasks'] == task
+        assert results['gradleVersion'] == testGradleVersion.gradleVersion.version
+        assert results['gradleHomeDir'] != null
+        assert results['buildFailed'] == hasFailure
+        assert results['configCacheHit'] == configCacheHit
+    }
+
+    void assertScanResults(boolean scanUploadFailed = false) {
+        def scanResults = new JsonSlurper().parse(scanResultFile)
+        assert scanResults['buildScanUri'] == (scanUploadFailed ? null : "${mockScansServer.address}s/${PUBLIC_BUILD_SCAN_ID}")
+        assert scanResults['buildScanFailed'] == scanUploadFailed
+    }
+
+    private File getBuildResultFile() {
+        def buildResultsDir = new File(testProjectDir, '.gradle-actions/build-results')
+        assert buildResultsDir.directory
+        assert buildResultsDir.listFiles().size() == 1
+        def resultsFile = buildResultsDir.listFiles()[0]
+        assert resultsFile.name.startsWith('github-step-id')
+        assert resultsFile.text.count('rootProjectName') == 1
+        return resultsFile
+    }
+
+    private File getScanResultFile() {
+        def buildResultsDir = new File(testProjectDir, '.gradle-actions/build-scans')
+        assert buildResultsDir.directory
+        assert buildResultsDir.listFiles().size() == 1
+        def resultsFile = buildResultsDir.listFiles()[0]
+        assert resultsFile.name.startsWith('github-step-id')
+        assert resultsFile.text.count('buildScanUri') == 1
+        return resultsFile
+    }
+}

sources/test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/TestDependencyGraph.groovy

@@ -0,0 +1,213 @@
+package com.gradle.gradlebuildaction
+
+import org.gradle.util.GradleVersion
+
+import static org.junit.Assume.assumeTrue
+
+class TestDependencyGraph extends BaseInitScriptTest {
+    def initScript = 'gradle-actions.github-dependency-graph.init.gradle'
+
+    static final TestGradleVersion GRADLE_5_1 = new TestGradleVersion(GradleVersion.version('5.1.1'), 8, 12)
+    static final TestGradleVersion GRADLE_7_0 = new TestGradleVersion(GradleVersion.version('7.0.1'), 8, 12)
+
+    static final List<TestGradleVersion> NO_DEPENDENCY_GRAPH_VERSIONS = [GRADLE_3_X, GRADLE_4_X, GRADLE_5_1, GRADLE_7_0]
+    static final List<TestGradleVersion> DEPENDENCY_GRAPH_VERSIONS = ALL_VERSIONS - NO_DEPENDENCY_GRAPH_VERSIONS
+
+    def "does not produce dependency graph when not enabled"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        run(['help'], initScript, testGradleVersion.gradleVersion)
+
+        then:
+        assert !reportsDir.exists()
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "produces dependency graph when enabled"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        run(['help'], initScript, testGradleVersion.gradleVersion, jvmArgs, envVars)
+
+        then:
+        assert reportFile.exists()
+
+        where:
+        testGradleVersion << DEPENDENCY_GRAPH_VERSIONS
+    }
+
+    def "produces dependency graph with configuration-cache on latest Gradle"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        run(['help', '--configuration-cache'], initScript, testGradleVersion.gradleVersion, jvmArgs, envVars)
+
+        then:
+        assert reportFile.exists()
+
+        where:
+        // Dependency-graph plugin doesn't support config-cache for 8.0 of Gradle
+        testGradleVersion << [GRADLE_8_X]
+    }
+
+    def "warns and produces no dependency graph when enabled for older Gradle versions"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def result = run(['help'], initScript, testGradleVersion.gradleVersion, jvmArgs, envVars)
+
+        then:
+        assert !reportsDir.exists()
+        assert result.output.contains("::warning::Dependency Graph is not supported for ${testGradleVersion}")
+
+        where:
+        testGradleVersion << NO_DEPENDENCY_GRAPH_VERSIONS
+    }
+
+    def "fails build when enabled for older Gradle versions if continue-on-failure is false"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def vars = envVars
+        vars.put('GITHUB_DEPENDENCY_GRAPH_CONTINUE_ON_FAILURE', 'false')
+        def args = jvmArgs
+        Collections.replaceAll(args,
+            '-DGITHUB_DEPENDENCY_GRAPH_CONTINUE_ON_FAILURE=true',
+            '-DGITHUB_DEPENDENCY_GRAPH_CONTINUE_ON_FAILURE=false'
+        )
+        def result = runAndFail(['help'], initScript, testGradleVersion.gradleVersion, args, vars)
+
+        then:
+        assert !reportsDir.exists()
+        assert result.output.contains("Dependency Graph is not supported for ${testGradleVersion}")
+
+        where:
+        testGradleVersion << NO_DEPENDENCY_GRAPH_VERSIONS
+    }
+
+    def "constructs unique job correlator for each build invocation"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        def reportFile1 = new File(reportsDir, "CORRELATOR-1.json")
+        def reportFile2 = new File(reportsDir, "CORRELATOR-2.json")
+
+        buildFile << """
+            task firstTask {
+                doLast {
+                    println "First"
+                }
+            }
+            task secondTask {
+                doLast {
+                    println "Second"
+                }
+            }
+        """
+
+        when:
+        run(['help'], initScript, testGradleVersion.gradleVersion, jvmArgs, envVars)
+
+        then:
+        assert reportFile.exists()
+
+        when:
+        run(['first'], initScript, testGradleVersion.gradleVersion, jvmArgs, envVars)
+
+        then:
+        assert reportFile.exists()
+        assert reportFile1.exists()
+        
+        when:
+        run(['second'], initScript, testGradleVersion.gradleVersion, jvmArgs, envVars)
+
+        then:
+        assert reportFile.exists()
+        assert reportFile1.exists()
+        assert reportFile2.exists()
+        
+        where:
+        testGradleVersion << DEPENDENCY_GRAPH_VERSIONS
+    }
+
+    def "can configure alternative repository for plugins"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def vars = envVars
+        vars.put('GRADLE_PLUGIN_REPOSITORY_URL', 'https://plugins.grdev.net/m2')
+        // TODO:DAZ This props are set too late to control init-script plugin resolution
+        // This makes the tests fail on Mac with Gradle < 6
+        def args = jvmArgs
+        args.add('-DGRADLE_PLUGIN_REPOSITORY_URL=https://plugins.grdev.net/m2')
+        def result = run(['help', '--info'], initScript, testGradleVersion.gradleVersion, args, vars)
+
+        then:
+        assert reportFile.exists()
+        assert result.output.find("Resolving dependency graph plugin [\\d\\.]+ from plugin repository: https://plugins.grdev.net/m2")
+
+        where:
+        testGradleVersion << DEPENDENCY_GRAPH_VERSIONS
+    }
+
+    def "can provide credentials for alternative repository for plugins"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def vars = envVars
+        vars.put('GRADLE_PLUGIN_REPOSITORY_URL', 'https://plugins.grdev.net/m2')
+        vars.put('GRADLE_PLUGIN_REPOSITORY_USERNAME', 'REPO_USER')
+        vars.put('GRADLE_PLUGIN_REPOSITORY_PASSWORD', 'REPO_PASSWORD')
+        // TODO:DAZ This props are set too late to control init-script plugin resolution
+        // This makes the tests fail on Mac with Gradle < 6
+        def args = jvmArgs
+        args.add('-DGRADLE_PLUGIN_REPOSITORY_URL=https://plugins.grdev.net/m2')
+        args.add('-DGRADLE_PLUGIN_REPOSITORY_USERNAME=REPO_USER')
+        args.add('-DGRADLE_PLUGIN_REPOSITORY_PASSWORD=REPO_PASSWORD')
+        def result = run(['help', '--info'], initScript, testGradleVersion.gradleVersion, args, vars)
+
+        then:
+        assert reportFile.exists()
+        assert result.output.find("Resolving dependency graph plugin [\\d\\.]+ from plugin repository: https://plugins.grdev.net/m2")
+        assert result.output.contains("Applying credentials for plugin repository: https://plugins.grdev.net/m2")
+
+        where:
+        testGradleVersion << DEPENDENCY_GRAPH_VERSIONS
+    }
+
+    def getEnvVars() {
+        return [
+            GITHUB_DEPENDENCY_GRAPH_ENABLED: "true",
+            GITHUB_DEPENDENCY_GRAPH_CONTINUE_ON_FAILURE: "true",
+            GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR: "CORRELATOR",
+            GITHUB_DEPENDENCY_GRAPH_JOB_ID: "1",
+            GITHUB_DEPENDENCY_GRAPH_REF: "main",
+            GITHUB_DEPENDENCY_GRAPH_SHA: "123456",
+            GITHUB_DEPENDENCY_GRAPH_WORKSPACE: testProjectDir.absolutePath,
+            DEPENDENCY_GRAPH_REPORT_DIR: reportsDir.absolutePath,
+        ]
+    }
+
+    def getJvmArgs() {
+        return [
+            "-DGITHUB_DEPENDENCY_GRAPH_ENABLED=true",
+            "-DGITHUB_DEPENDENCY_GRAPH_CONTINUE_ON_FAILURE=true",
+            "-DGITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR=CORRELATOR",
+            "-DGITHUB_DEPENDENCY_GRAPH_JOB_ID=1",
+            "-DGITHUB_DEPENDENCY_GRAPH_REF=main",
+            "-DGITHUB_DEPENDENCY_GRAPH_SHA=123456",
+            "-DGITHUB_DEPENDENCY_GRAPH_WORKSPACE=" + testProjectDir.absolutePath,
+            "-DDEPENDENCY_GRAPH_REPORT_DIR=" + reportsDir.absolutePath,
+        ].collect {it.toString() } // Convert from GString to String
+    }
+
+    def getReportsDir() {
+        return new File(testProjectDir, 'build/reports/github-dependency-graph-snapshots')
+    }
+
+    def getReportFile() {
+        return new File(reportsDir, "CORRELATOR.json")
+    }
+}

sources/test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/TestDevelocityInjection.groovy

@@ -0,0 +1,521 @@
+package com.gradle.gradlebuildaction
+
+import org.gradle.testkit.runner.BuildResult
+import org.gradle.util.GradleVersion
+import spock.lang.Requires
+
+import static org.junit.Assume.assumeTrue
+
+class TestDevelocityInjection extends BaseInitScriptTest {
+    static final List<TestGradleVersion> CCUD_COMPATIBLE_VERSIONS = ALL_VERSIONS - [GRADLE_3_X]
+
+    def initScript = 'gradle-actions.inject-develocity.init.gradle'
+
+    private static final GradleVersion GRADLE_5 = GradleVersion.version('5.0')
+
+    def "does not apply Develocity plugins when not requested"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def result = run([], initScript, testGradleVersion.gradleVersion)
+
+        then:
+        outputMissesDevelocityPluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "does not override Develocity plugin when already defined in project"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        given:
+        declareDevelocityPluginApplication(testGradleVersion.gradleVersion)
+
+        when:
+        def result = run(testGradleVersion, testConfig())
+
+        then:
+        outputMissesDevelocityPluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    @Requires(
+            value = { data.testGradleVersion.gradleVersion >= GradleVersion.version("5.0") },
+            reason = "Prior to Gradle 5.0, we apply a fixed version of the plugin, which can't introduce this conflict"
+    )
+    def "does not override GE or Build Scan plugins even if Develocity plugin is requested"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        given:
+        declareLegacyGradleEnterprisePluginApplication(testGradleVersion.gradleVersion)
+
+        when:
+        def result = run(testGradleVersion, testConfig())
+
+        then:
+        outputMissesDevelocityPluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "applies Develocity plugin via init script when not defined in project"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def result = run(testGradleVersion, testConfig())
+
+        then:
+        outputContainsDevelocityPluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "applies deprecated Gradle Enterprise or Build Scan plugins if requested"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        given:
+        def appliedPluginClass = testGradleVersion.gradleVersion >= GradleVersion.version("6.0")
+                ? "com.gradle.enterprise.gradleplugin.GradleEnterprisePlugin"
+                : "com.gradle.scan.plugin.BuildScanPlugin"
+
+        when:
+        // 3.16.2 is the latest version of deprecated plugins
+        def result = run(testGradleVersion, testConfig('3.16.2'))
+
+        then:
+        1 == result.output.count("Applying $appliedPluginClass via init script")
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "applies Develocity and CCUD plugins via init script when not defined in project"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def result = run(testGradleVersion, testConfig().withCCUDPlugin())
+
+        then:
+        outputContainsDevelocityPluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputContainsCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << CCUD_COMPATIBLE_VERSIONS
+    }
+
+    def "applies CCUD plugin via init script where Develocity plugin already applied"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        given:
+        declareDevelocityPluginApplication(testGradleVersion.gradleVersion)
+
+        when:
+        // Init-script emits deprecation warnings when CCUD plugin is applied on Gradle 5.6.4
+        if (testGradleVersion.gradleVersion.version == "5.6.4") {
+            allowDevelocityDeprecationWarning = true
+        }
+        def result = run(testGradleVersion, testConfig().withCCUDPlugin())
+
+        then:
+        outputMissesDevelocityPluginApplicationViaInitScript(result)
+        outputContainsCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << CCUD_COMPATIBLE_VERSIONS
+    }
+
+    def "does not override CCUD plugin when already defined in project"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        given:
+        declareDevelocityPluginAndCcudPluginApplication(testGradleVersion.gradleVersion)
+
+        when:
+        def result = run(testGradleVersion, testConfig().withCCUDPlugin())
+
+        then:
+        outputMissesDevelocityPluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << CCUD_COMPATIBLE_VERSIONS
+    }
+
+    def "ignores Develocity URL and allowUntrustedServer when Develocity plugin is not applied by the init script"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        given:
+        declareDevelocityPluginApplication(testGradleVersion.gradleVersion)
+
+        when:
+        def config = testConfig().withServer(URI.create('https://develocity-server.invalid'))
+        def result = run(testGradleVersion, config)
+
+        then:
+        outputMissesDevelocityPluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "configures Develocity URL and allowUntrustedServer when Develocity plugin is applied by the init script"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def config = testConfig().withServer(mockScansServer.address)
+        def result = run(testGradleVersion, config)
+
+        then:
+        outputContainsDevelocityPluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputContainsDevelocityConnectionInfo(result, mockScansServer.address.toString(), true)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+        outputContainsPluginRepositoryInfo(result, 'https://plugins.gradle.org/m2')
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "enforces Develocity URL and allowUntrustedServer in project if enforce url parameter is enabled"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        given:
+        declareDevelocityPluginApplication(testGradleVersion.gradleVersion, URI.create('https://develocity-server.invalid'))
+
+        when:
+        def config = testConfig().withServer(mockScansServer.address, true)
+        def result = run(testGradleVersion, config)
+
+        then:
+        outputMissesDevelocityPluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputEnforcesDevelocityUrl(result, mockScansServer.address.toString(), true)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "can configure alternative repository for plugins when Develocity plugin is applied by the init script"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def config = testConfig().withPluginRepository(new URI('https://plugins.grdev.net/m2'))
+        def result = run(testGradleVersion, config)
+
+        then:
+        outputContainsDevelocityPluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputContainsDevelocityConnectionInfo(result, mockScansServer.address.toString(), true)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+        outputContainsPluginRepositoryInfo(result, 'https://plugins.grdev.net/m2')
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "can configure alternative repository for plugins with credentials when Develocity plugin is applied by the init script"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def config = testConfig().withPluginRepository(new URI('https://plugins.grdev.net/m2')).withPluginRepositoryCredentials("john", "doe")
+        def result = run(testGradleVersion, config)
+
+        then:
+        outputContainsDevelocityPluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputContainsDevelocityConnectionInfo(result, mockScansServer.address.toString(), true)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+        outputContainsPluginRepositoryInfo(result, 'https://plugins.grdev.net/m2', true)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "can configure capturing file fingerprints when Develocity plugin is applied by the init script"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def config = testConfig().withCaptureFileFingerprints()
+        def result = run(testGradleVersion, config)
+
+        then:
+        outputContainsDevelocityPluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputContainsDevelocityConnectionInfo(result, mockScansServer.address.toString(), true)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+        if (testGradleVersion.gradleVersion >= GRADLE_5_X.gradleVersion) {
+            outputCaptureFileFingerprints(result, true)
+        }
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "stops gracefully when requested CCUD plugin version is <1.7"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def config = testConfig().withCCUDPlugin("1.6.6")
+        def result = run(testGradleVersion, config)
+
+        then:
+        outputMissesDevelocityPluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+        result.output.contains('Common Custom User Data Gradle plugin must be at least 1.7. Configured version is 1.6.6.')
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "can configure Develocity via CCUD system property overrides when CCUD plugin is inject via init script"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def config = testConfig().withCCUDPlugin().withServer(URI.create('https://develocity-server.invalid'))
+        def result = run(testGradleVersion, config, ["help", "-Ddevelocity.url=${mockScansServer.address}".toString()])
+
+        then:
+        outputContainsDevelocityPluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputContainsCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << CCUD_COMPATIBLE_VERSIONS
+    }
+
+    def "init script is configuration cache compatible"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def config = testConfig().withCCUDPlugin()
+        def result = run(testGradleVersion, config, ["help", "--configuration-cache"])
+
+        then:
+        outputContainsDevelocityPluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputContainsCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        when:
+        result = run(testGradleVersion, config, ["help", "--configuration-cache"])
+
+        then:
+        outputMissesDevelocityPluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << CONFIGURATION_CACHE_VERSIONS
+    }
+
+    void outputContainsBuildScanUrl(BuildResult result) {
+        def message = "Publishing build scan...\n${mockScansServer.address}s/$PUBLIC_BUILD_SCAN_ID"
+        assert result.output.contains(message)
+        assert 1 == result.output.count(message)
+    }
+
+    void outputContainsDevelocityPluginApplicationViaInitScript(BuildResult result, GradleVersion gradleVersion) {
+        def pluginApplicationLogMsgGradle4 = "Applying com.gradle.scan.plugin.BuildScanPlugin via init script"
+        def pluginApplicationLogMsgGradle5AndHigher = "Applying com.gradle.develocity.agent.gradle.DevelocityPlugin via init script"
+        if (gradleVersion < GRADLE_5) {
+            assert result.output.contains(pluginApplicationLogMsgGradle4)
+            assert 1 == result.output.count(pluginApplicationLogMsgGradle4)
+            assert !result.output.contains(pluginApplicationLogMsgGradle5AndHigher)
+        } else {
+            assert result.output.contains(pluginApplicationLogMsgGradle5AndHigher)
+            assert 1 == result.output.count(pluginApplicationLogMsgGradle5AndHigher)
+            assert !result.output.contains(pluginApplicationLogMsgGradle4)
+        }
+    }
+
+    void outputMissesDevelocityPluginApplicationViaInitScript(BuildResult result) {
+        def pluginApplicationLogMsgGradle4 = "Applying com.gradle.scan.plugin.BuildScanPlugin via init script"
+        def pluginApplicationLogMsgGradle5AndHigher = "Applying com.gradle.develocity.agent.gradle.DevelocityPlugin via init script"
+        assert !result.output.contains(pluginApplicationLogMsgGradle4)
+        assert !result.output.contains(pluginApplicationLogMsgGradle5AndHigher)
+    }
+
+    void outputContainsCcudPluginApplicationViaInitScript(BuildResult result) {
+        def pluginApplicationLogMsg = "Applying com.gradle.CommonCustomUserDataGradlePlugin via init script"
+        assert result.output.contains(pluginApplicationLogMsg)
+        assert 1 == result.output.count(pluginApplicationLogMsg)
+    }
+
+    void outputMissesCcudPluginApplicationViaInitScript(BuildResult result) {
+        def pluginApplicationLogMsg = "Applying com.gradle.CommonCustomUserDataGradlePlugin via init script"
+        assert !result.output.contains(pluginApplicationLogMsg)
+    }
+
+    void outputContainsDevelocityConnectionInfo(BuildResult result, String develocityUrl, boolean develocityAllowUntrustedServer) {
+        def develocityConnectionInfo = "Connection to Develocity: $develocityUrl, allowUntrustedServer: $develocityAllowUntrustedServer"
+        assert result.output.contains(develocityConnectionInfo)
+        assert 1 == result.output.count(develocityConnectionInfo)
+    }
+
+    void outputCaptureFileFingerprints(BuildResult result, boolean captureFileFingerprints) {
+        def captureFileFingerprintsInfo = "Setting captureFileFingerprints: $captureFileFingerprints"
+        assert result.output.contains(captureFileFingerprintsInfo)
+        assert 1 == result.output.count(captureFileFingerprintsInfo)
+    }
+
+    void outputContainsPluginRepositoryInfo(BuildResult result, String gradlePluginRepositoryUrl, boolean withCredentials = false) {
+        def repositoryInfo = "Develocity plugins resolution: ${gradlePluginRepositoryUrl}"
+        assert result.output.contains(repositoryInfo)
+        assert 1 == result.output.count(repositoryInfo)
+
+        if (withCredentials) {
+            def credentialsInfo = "Using credentials for plugin repository"
+            assert result.output.contains(credentialsInfo)
+            assert 1 == result.output.count(credentialsInfo)
+        }
+    }
+
+    void outputEnforcesDevelocityUrl(BuildResult result, String develocityUrl, boolean develocityAllowUntrustedServer) {
+        def enforceUrl = "Enforcing Develocity: $develocityUrl, allowUntrustedServer: $develocityAllowUntrustedServer"
+        assert result.output.contains(enforceUrl)
+        assert 1 == result.output.count(enforceUrl)
+    }
+
+    private BuildResult run(TestGradleVersion testGradleVersion, TestConfig config, List<String> args = ["help"]) {
+        return run(args, initScript, testGradleVersion.gradleVersion, config.jvmArgs, config.envVars)
+    }
+
+    private TestConfig testConfig(String develocityPluginVersion = DEVELOCITY_PLUGIN_VERSION) {
+        new TestConfig(develocityPluginVersion)
+    }
+
+    class TestConfig {
+        String serverUrl = mockScansServer.address.toString()
+        boolean enforceUrl = false
+        String ccudPluginVersion = null
+        String pluginRepositoryUrl = null
+        String pluginRepositoryUsername = null
+        String pluginRepositoryPassword = null
+        boolean captureFileFingerprints = false
+        String develocityPluginVersion
+
+        TestConfig(String develocityPluginVersion) {
+            this.develocityPluginVersion = develocityPluginVersion
+        }
+
+        TestConfig withCCUDPlugin(String version = CCUD_PLUGIN_VERSION) {
+            ccudPluginVersion = version
+            return this
+        }
+
+        TestConfig withServer(URI url, boolean enforceUrl = false) {
+            serverUrl = url.toASCIIString()
+            this.enforceUrl = enforceUrl
+            return this
+        }
+
+        TestConfig withPluginRepository(URI pluginRepositoryUrl) {
+            this.pluginRepositoryUrl = pluginRepositoryUrl
+            return this
+        }
+
+        TestConfig withCaptureFileFingerprints() {
+            this.captureFileFingerprints = true
+            return this
+        }
+
+        TestConfig withPluginRepositoryCredentials(String pluginRepoUsername, String pluginRepoPassword) {
+            this.pluginRepositoryUsername = pluginRepoUsername
+            this.pluginRepositoryPassword = pluginRepoPassword
+            return this
+        }
+
+        def getEnvVars() {
+            Map<String, String> envVars = [
+                DEVELOCITY_INJECTION_INIT_SCRIPT_NAME     : "gradle-actions.inject-develocity.init.gradle",
+                DEVELOCITY_INJECTION_ENABLED              : "true",
+                DEVELOCITY_URL                            : serverUrl,
+                DEVELOCITY_ALLOW_UNTRUSTED_SERVER         : "true",
+                DEVELOCITY_PLUGIN_VERSION                 : develocityPluginVersion,
+                DEVELOCITY_BUILD_SCAN_UPLOAD_IN_BACKGROUND: "true", // Need to upload in background since our Mock server doesn't cope with foreground upload
+                DEVELOCITY_AUTO_INJECTION_CUSTOM_VALUE    : 'gradle-actions'
+            ]
+            if (enforceUrl) envVars.put("DEVELOCITY_ENFORCE_URL", "true")
+            if (ccudPluginVersion != null) envVars.put("DEVELOCITY_CCUD_PLUGIN_VERSION", ccudPluginVersion)
+            if (pluginRepositoryUrl != null) envVars.put("GRADLE_PLUGIN_REPOSITORY_URL", pluginRepositoryUrl)
+            if (pluginRepositoryUsername != null) envVars.put("GRADLE_PLUGIN_REPOSITORY_USERNAME", pluginRepositoryUsername)
+            if (pluginRepositoryPassword != null) envVars.put("GRADLE_PLUGIN_REPOSITORY_PASSWORD", pluginRepositoryPassword)
+            if (captureFileFingerprints) envVars.put("DEVELOCITY_CAPTURE_FILE_FINGERPRINTS", "true")
+
+            return envVars
+        }
+
+        def getJvmArgs() {
+            List<String> jvmArgs = [
+                "-Ddevelocity.injection.init-script-name=gradle-actions.inject-develocity.init.gradle",
+                "-Ddevelocity.injection-enabled=true",
+                "-Ddevelocity.url=$serverUrl",
+                "-Ddevelocity.allow-untrusted-server=true",
+                "-Ddevelocity.plugin.version=$develocityPluginVersion",
+                "-Ddevelocity.build-scan.upload-in-background=true",
+                "-Ddevelocity.auto-injection.custom-value=gradle-actions"
+            ]
+
+            if (enforceUrl) jvmArgs.add("-Ddevelocity.enforce-url=true")
+            if (ccudPluginVersion != null) jvmArgs.add("-Ddevelocity.ccud-plugin.version=$ccudPluginVersion")
+            if (pluginRepositoryUrl != null) jvmArgs.add("-Dgradle.plugin-repository.url=$pluginRepositoryUrl")
+            if (pluginRepositoryUsername != null) jvmArgs.add("-Dgradle.plugin-repository.username=$pluginRepositoryUsername")
+            if (pluginRepositoryPassword != null) jvmArgs.add("-Dgradle.plugin-repository.password=$pluginRepositoryPassword")
+            if (captureFileFingerprints) jvmArgs.add("-Ddevelocity.capture-file-fingerprints=true")
+
+            return jvmArgs.collect { it.toString() } // Convert from GStrings
+        }
+    }
+}

sources/test/jest/.gitignore

@@ -0,0 +1 @@
+tmp

sources/test/jest/cache-cleanup.test.ts

@@ -0,0 +1,109 @@
+import * as exec from '@actions/exec'
+import * as core from '@actions/core'
+import * as glob from '@actions/glob'
+import fs from 'fs'
+import path from 'path'
+import {CacheCleaner} from '../../src/caching/cache-cleaner'
+
+jest.setTimeout(120000)
+
+test('will cleanup unused dependency jars and build-cache entries', async () => {
+    const projectRoot = prepareTestProject()
+    const gradleUserHome = path.resolve(projectRoot, 'HOME')
+    const tmpDir = path.resolve(projectRoot, 'tmp')
+    const cacheCleaner = new CacheCleaner(gradleUserHome, tmpDir)
+
+    await runGradleBuild(projectRoot, 'build', '3.1')
+    
+    const timestamp = await cacheCleaner.prepare()
+
+    await runGradleBuild(projectRoot, 'build', '3.1.1')
+
+    const commonsMath31 = path.resolve(gradleUserHome, "caches/modules-2/files-2.1/org.apache.commons/commons-math3/3.1")
+    const commonsMath311 = path.resolve(gradleUserHome, "caches/modules-2/files-2.1/org.apache.commons/commons-math3/3.1.1")
+    const buildCacheDir = path.resolve(gradleUserHome, "caches/build-cache-1")
+
+    expect(fs.existsSync(commonsMath31)).toBe(true)
+    expect(fs.existsSync(commonsMath311)).toBe(true)
+    expect(fs.readdirSync(buildCacheDir).length).toBe(4) // gc.properties, build-cache-1.lock, and 2 task entries
+
+    await cacheCleaner.forceCleanupFilesOlderThan(timestamp)
+
+    expect(fs.existsSync(commonsMath31)).toBe(false)
+    expect(fs.existsSync(commonsMath311)).toBe(true)
+    expect(fs.readdirSync(buildCacheDir).length).toBe(3) // 1 task entry has been cleaned up
+})
+
+test('will cleanup unused gradle versions', async () => {
+    const projectRoot = prepareTestProject()
+    const gradleUserHome = path.resolve(projectRoot, 'HOME')
+    const tmpDir = path.resolve(projectRoot, 'tmp')
+    const cacheCleaner = new CacheCleaner(gradleUserHome, tmpDir)
+
+    // Initialize HOME with 2 different Gradle versions
+    await runGradleWrapperBuild(projectRoot, 'build')
+    await runGradleBuild(projectRoot, 'build')
+
+    const timestamp = await cacheCleaner.prepare()
+
+    // Run with only one of these versions
+    await runGradleBuild(projectRoot, 'build')
+
+    const gradle802 = path.resolve(gradleUserHome, "caches/8.0.2")
+    const transforms3 = path.resolve(gradleUserHome, "caches/transforms-3")
+    const metadata100 = path.resolve(gradleUserHome, "caches/modules-2/metadata-2.100")
+    const wrapper802 = path.resolve(gradleUserHome, "wrapper/dists/gradle-8.0.2-bin")
+    const gradleCurrent = path.resolve(gradleUserHome, "caches/8.10")
+    const metadataCurrent = path.resolve(gradleUserHome, "caches/modules-2/metadata-2.106")
+
+    expect(fs.existsSync(gradle802)).toBe(true)
+    expect(fs.existsSync(transforms3)).toBe(true)
+    expect(fs.existsSync(metadata100)).toBe(true)
+    expect(fs.existsSync(wrapper802)).toBe(true)
+
+    expect(fs.existsSync(gradleCurrent)).toBe(true)
+    expect(fs.existsSync(metadataCurrent)).toBe(true)
+
+    // The wrapper won't be removed if it was recently downloaded. Age it.
+    setUtimes(wrapper802, new Date(Date.now() - 48 * 60 * 60 * 1000))
+
+    await cacheCleaner.forceCleanupFilesOlderThan(timestamp)
+
+    expect(fs.existsSync(gradle802)).toBe(false)
+    expect(fs.existsSync(transforms3)).toBe(false)
+    expect(fs.existsSync(metadata100)).toBe(false)
+    expect(fs.existsSync(wrapper802)).toBe(false)
+
+    expect(fs.existsSync(gradleCurrent)).toBe(true)
+    expect(fs.existsSync(metadataCurrent)).toBe(true)
+})
+
+async function runGradleBuild(projectRoot: string, args: string, version: string = '3.1'): Promise<void> {
+    const status31 = await exec.exec(`gradle -g HOME --no-daemon --build-cache -Dcommons_math3_version="${version}" ${args}`, [], {
+        cwd: projectRoot
+    })
+    console.log(`Gradle User Home initialized with commons_math3_version=${version} ${args}`)
+}
+
+async function runGradleWrapperBuild(projectRoot: string, args: string, version: string = '3.1'): Promise<void> {
+    const status31 = await exec.exec(`./gradlew -g HOME --no-daemon --build-cache -Dcommons_math3_version="${version}" ${args}`, [], {
+        cwd: projectRoot
+    })
+    console.log(`Gradle User Home initialized with commons_math3_version="${version}" ${args}`)
+}
+
+function prepareTestProject(): string {
+    const projectRoot = 'test/jest/resources/cache-cleanup'
+    fs.rmSync(path.resolve(projectRoot, 'HOME'), { recursive: true, force: true })
+    fs.rmSync(path.resolve(projectRoot, 'tmp'), { recursive: true, force: true })
+    fs.rmSync(path.resolve(projectRoot, 'build'), { recursive: true, force: true })
+    fs.rmSync(path.resolve(projectRoot, '.gradle'), { recursive: true, force: true })
+    return projectRoot
+}
+
+async function setUtimes(pattern: string, timestamp: Date): Promise<void> {
+    const globber = await glob.create(pattern)
+    for await (const file of globber.globGenerator()) {
+        fs.utimesSync(file, timestamp, timestamp)
+    }
+}

sources/test/jest/cache-debug.test.ts

@@ -0,0 +1,35 @@
+import * as path from 'path'
+import * as fs from 'fs'
+import {GradleUserHomeCache} from "../../src/caching/gradle-user-home-cache"
+import {CacheConfig} from "../../src/configuration"
+
+const testTmp = 'test/jest/tmp'
+fs.rmSync(testTmp, {recursive: true, force: true})
+
+describe("--info and --stacktrace", () => {
+    describe("will be created", () => {
+        it("when gradle.properties does not exists", async () => {
+            const emptyGradleHome = `${testTmp}/empty-gradle-home`
+            fs.mkdirSync(emptyGradleHome, {recursive: true})
+
+            const stateCache = new GradleUserHomeCache("ignored", emptyGradleHome, new CacheConfig())
+            stateCache.configureInfoLogLevel()
+
+            expect(fs.readFileSync(path.resolve(emptyGradleHome, "gradle.properties"), 'utf-8'))
+                .toBe("org.gradle.logging.level=info\norg.gradle.logging.stacktrace=all\n")
+        })
+    })
+    describe("will be added", () => {
+        it("and gradle.properties does exists", async () => {
+            const existingGradleHome = `${testTmp}/existing-gradle-home`
+            fs.mkdirSync(existingGradleHome, {recursive: true})
+            fs.writeFileSync(path.resolve(existingGradleHome, "gradle.properties"), "org.gradle.logging.level=debug\n")
+
+            const stateCache = new GradleUserHomeCache("ignored", existingGradleHome, new CacheConfig())
+            stateCache.configureInfoLogLevel()
+
+            expect(fs.readFileSync(path.resolve(existingGradleHome, "gradle.properties"), 'utf-8'))
+                .toBe("org.gradle.logging.level=info\norg.gradle.logging.stacktrace=all\n\norg.gradle.logging.level=debug\n")
+        })
+    })
+})

sources/test/jest/cache-reporting.test.ts

@@ -0,0 +1,98 @@
+import exp from 'constants'
+import {CacheEntryListener, CacheListener} from '../../src/caching/cache-reporting'
+
+describe('caching report', () => {
+    describe('reports not fully restored', () => {
+        it('with one requested entry report', async () => {
+            const report = new CacheListener()
+            report.entry('foo').markRequested('1', ['2'])
+            report.entry('bar').markRequested('3').markRestored('4', 500, 1000)
+            expect(report.fullyRestored).toBe(false)
+        })
+    })
+    describe('reports fully restored', () => {
+        it('when empty', async () => {
+            const report = new CacheListener()
+            expect(report.fullyRestored).toBe(true)
+        })
+        it('with empty entry reports', async () => {
+            const report = new CacheListener()
+            report.entry('foo')
+            report.entry('bar')
+            expect(report.fullyRestored).toBe(true)
+        })
+        it('with restored entry report', async () => {
+            const report = new CacheListener()
+            report.entry('bar').markRequested('3').markRestored('4', 300, 1000)
+            expect(report.fullyRestored).toBe(true)
+        })
+        it('with multiple restored entry reportss', async () => {
+            const report = new CacheListener()
+            report.entry('foo').markRestored('4', 3300, 111)
+            report.entry('bar').markRequested('3').markRestored('4', 333, 1000)
+            expect(report.fullyRestored).toBe(true)
+        })
+    })
+    describe('can be stringified and rehydrated', () => {
+        it('when empty', async () => {
+            const report = new CacheListener()
+
+            const stringRep = report.stringify()
+            const reportClone: CacheListener = CacheListener.rehydrate(stringRep)
+
+            expect(reportClone.cacheEntries).toEqual([])
+
+            // Can call methods on rehydrated
+            expect(reportClone.entry('foo')).toBeInstanceOf(CacheEntryListener)
+        })
+        it('with entry reports', async () => {
+            const report = new CacheListener()
+            report.entry('foo')
+            report.entry('bar')
+            report.entry('baz')
+
+            const stringRep = report.stringify()
+            const reportClone: CacheListener = CacheListener.rehydrate(stringRep)
+
+            expect(reportClone.cacheEntries.length).toBe(3)
+            expect(reportClone.cacheEntries[0].entryName).toBe('foo')
+            expect(reportClone.cacheEntries[1].entryName).toBe('bar')
+            expect(reportClone.cacheEntries[2].entryName).toBe('baz')
+
+            expect(reportClone.entry('foo')).toBe(reportClone.cacheEntries[0])
+        })
+        it('with rehydrated entry report', async () => {
+            const report = new CacheListener()
+            const entryReport = report.entry('foo')
+            entryReport.markRequested('1', ['2', '3'])
+            entryReport.markSaved('4', 100, 1000)
+
+            const stringRep = report.stringify()
+            const reportClone: CacheListener = CacheListener.rehydrate(stringRep)
+            const entryClone = reportClone.entry('foo')
+
+            expect(entryClone.requestedKey).toBe('1')
+            expect(entryClone.requestedRestoreKeys).toEqual(['2', '3'])
+            expect(entryClone.savedKey).toBe('4')
+            expect(entryClone.savedSize).toBe(100)
+            expect(entryClone.savedTime).toBe(1000)
+        })
+        it('with live entry report', async () => {
+            const report = new CacheListener()
+            const entryReport = report.entry('foo')
+            entryReport.markRequested('1', ['2', '3'])
+
+            const stringRep = report.stringify()
+            const reportClone: CacheListener = CacheListener.rehydrate(stringRep)
+            const entryClone = reportClone.entry('foo')
+
+            // Check type and call method on rehydrated entry report
+            expect(entryClone).toBeInstanceOf(CacheEntryListener)
+            entryClone.markSaved('4', 100, 1000)
+
+            expect(entryClone.requestedKey).toBe('1')
+            expect(entryClone.requestedRestoreKeys).toEqual(['2', '3'])
+            expect(entryClone.savedKey).toBe('4')
+        })
+    })
+})

sources/test/jest/cache-utils.test.ts

@@ -0,0 +1,20 @@
+import * as cacheUtils from '../../src/caching/cache-utils'
+
+describe('cacheUtils-utils', () => {
+    describe('can hash', () => {
+        it('a string', async () => {
+            const hash = cacheUtils.hashStrings(['foo'])
+            expect(hash).toBe('acbd18db4cc2f85cedef654fccc4a4d8')
+        })
+        it('multiple strings', async () => {
+            const hash = cacheUtils.hashStrings(['foo', 'bar', 'baz'])
+            expect(hash).toBe('6df23dc03f9b54cc38a0fc1483df6e21')
+        })
+        it('normalized filenames', async () => {
+            const fileNames = ['/foo/bar/baz.zip', '../boo.html']
+            const posixHash = cacheUtils.hashFileNames(fileNames)
+            const windowsHash = cacheUtils.hashFileNames(fileNames)
+            expect(posixHash).toBe(windowsHash)
+        })
+    })
+})

sources/test/jest/configuration.test.ts

@@ -0,0 +1,22 @@
+import * as inputParams from '../../src/configuration'
+
+describe('input params', () => {
+    describe('parses numeric input', () => {
+        it('uses default value', () => {
+            const val = inputParams.parseNumericInput('param-name', '', 88)
+            expect(val).toBe(88)
+        })
+        it('parses numeric input', () => {
+            const val = inputParams.parseNumericInput('param-name', '34', 88)
+            expect(val).toBe(34)
+        })
+        it('fails on non-numeric input', () => {
+            const t = () => {
+                inputParams.parseNumericInput('param-name', 'xyz', 88)
+            };
+
+            expect(t).toThrow(TypeError)
+            expect(t).toThrow("The value 'xyz' is not a valid numeric value for 'param-name'.")
+        })
+    })
+})

sources/test/jest/dependency-graph.test.ts

@@ -0,0 +1,34 @@
+import { DependencyGraphConfig } from "../../src/configuration" 
+
+describe('dependency-graph', () => {
+    describe('constructs job correlator', () => {
+        it('removes commas from workflow name', () => {
+            const id = DependencyGraphConfig.constructJobCorrelator('Workflow, with,commas', 'jobid', '{}')
+            expect(id).toBe('workflow_withcommas-jobid')
+        })
+        it('removes non word characters', () => {
+            const id = DependencyGraphConfig.constructJobCorrelator('Workflow!_with()characters', 'job-*id', '{"foo": "bar!@#$%^&*("}')
+            expect(id).toBe('workflow_withcharacters-job-id-bar')
+        })
+        it('replaces spaces', () => {
+            const id = DependencyGraphConfig.constructJobCorrelator('Workflow !_ with () characters, and   spaces', 'job-*id', '{"foo": "bar!@#$%^&*("}')
+            expect(id).toBe('workflow___with_characters_and_spaces-job-id-bar')
+        })
+        it('without matrix', () => {
+            const id = DependencyGraphConfig.constructJobCorrelator('workflow', 'jobid', 'null')
+            expect(id).toBe('workflow-jobid')
+        })
+        it('with dashes in values', () => {
+            const id = DependencyGraphConfig.constructJobCorrelator('workflow-name', 'job-id', '{"os": "ubuntu-latest"}')
+            expect(id).toBe('workflow-name-job-id-ubuntu-latest')
+        })
+        it('with single matrix value', () => {
+            const id = DependencyGraphConfig.constructJobCorrelator('workflow', 'jobid', '{"os": "windows"}')
+            expect(id).toBe('workflow-jobid-windows')
+        })
+        it('with composite matrix value', () => {
+            const id = DependencyGraphConfig.constructJobCorrelator('workflow', 'jobid', '{"os": "windows", "java-version": "21.1", "other": "Value, with COMMA"}')
+            expect(id).toBe('workflow-jobid-windows-211-value_with_comma')
+        })
+    })
+})

sources/test/jest/gradle-version.test.ts

@@ -0,0 +1,104 @@
+import { describe } from 'node:test'
+import { versionIsAtLeast, parseGradleVersionFromOutput } from '../../src/execution/gradle'
+
+describe('gradle', () => {
+    describe('can compare version with', () => {
+        it('same version', async () => {
+            expect(versionIsAtLeast('6.7.1', '6.7.1')).toBe(true)
+            expect(versionIsAtLeast('7.0', '7.0')).toBe(true)
+            expect(versionIsAtLeast('7.0', '7.0.0')).toBe(true)
+        })
+        it('newer version', async () => {
+            expect(versionIsAtLeast('6.7.1', '6.7.2')).toBe(false)
+            expect(versionIsAtLeast('7.0', '8.0')).toBe(false)
+            expect(versionIsAtLeast('7.0', '7.0.1')).toBe(false)
+        })
+        it('older version', async () => {
+            expect(versionIsAtLeast('6.7.2', '6.7.1')).toBe(true)
+            expect(versionIsAtLeast('8.0', '7.0')).toBe(true)
+            expect(versionIsAtLeast('7.0.1', '7.0')).toBe(true)
+        })
+        it('rc version', async () => {
+            expect(versionIsAtLeast('8.0.2-rc-1', '8.0.1')).toBe(true)
+            expect(versionIsAtLeast('8.0.2-rc-1', '8.0.2')).toBe(false)
+            expect(versionIsAtLeast('8.1-rc-1', '8.0')).toBe(true)
+            expect(versionIsAtLeast('8.0-rc-1', '8.0')).toBe(false)
+        })
+        it('snapshot version', async () => {
+            expect(versionIsAtLeast('8.11-20240829002031+0000', '8.10')).toBe(true)
+            expect(versionIsAtLeast('8.11-20240829002031+0000', '8.10.1')).toBe(true)
+            expect(versionIsAtLeast('8.11-20240829002031+0000', '8.11')).toBe(false)
+
+            expect(versionIsAtLeast('8.10.2-20240828012138+0000', '8.10')).toBe(true)
+            expect(versionIsAtLeast('8.10.2-20240828012138+0000', '8.10.1')).toBe(true)
+            expect(versionIsAtLeast('8.10.2-20240828012138+0000', '8.10.2')).toBe(false)
+            expect(versionIsAtLeast('8.10.2-20240828012138+0000', '8.11')).toBe(false)
+
+            expect(versionIsAtLeast('9.1-branch-provider_api_migration_public_api_changes-20240826121451+0000', '9.0')).toBe(true)
+            expect(versionIsAtLeast('9.1-branch-provider_api_migration_public_api_changes-20240826121451+0000', '9.0.1')).toBe(true)
+            expect(versionIsAtLeast('9.1-branch-provider_api_migration_public_api_changes-20240826121451+0000', '9.1')).toBe(false)
+        })
+    })
+    describe('can parse version from output', () => {
+        it('major version', async () => {
+            const output = `
+    ------------------------------------------------------------
+    Gradle 8.9
+    ------------------------------------------------------------
+    `
+            const version = await parseGradleVersionFromOutput(output)!
+            expect(version).toBe('8.9')
+        })
+    
+        it('patch version', async () => {
+            const output = `
+    ------------------------------------------------------------
+    Gradle 8.9.1
+    ------------------------------------------------------------
+    `
+            const version = await parseGradleVersionFromOutput(output)!
+            expect(version).toBe('8.9.1')
+        })
+    
+        it('rc version', async () => {
+            const output = `
+    ------------------------------------------------------------
+    Gradle 8.9-rc-1
+    ------------------------------------------------------------
+    `
+            const version = await parseGradleVersionFromOutput(output)!
+            expect(version).toBe('8.9-rc-1')
+        })
+    
+        it('milestone version', async () => {
+            const output = `
+    ------------------------------------------------------------
+    Gradle 8.0-milestone-6
+    ------------------------------------------------------------
+    `
+            const version = await parseGradleVersionFromOutput(output)!
+            expect(version).toBe('8.0-milestone-6')
+        })
+    
+        it('snapshot version', async () => {
+            const output = `
+    ------------------------------------------------------------
+    Gradle 8.10.2-20240828012138+0000
+    ------------------------------------------------------------
+    `
+            const version = await parseGradleVersionFromOutput(output)!
+            expect(version).toBe('8.10.2-20240828012138+0000')
+        })
+    
+        it('branch version', async () => {
+            const output = `
+    ------------------------------------------------------------
+    Gradle 9.0-branch-provider_api_migration_public_api_changes-20240830060514+0000
+    ------------------------------------------------------------
+    `
+            const version = await parseGradleVersionFromOutput(output)!
+            expect(version).toBe('9.0-branch-provider_api_migration_public_api_changes-20240830060514+0000')
+        })
+    })
+})
+

sources/test/jest/job-summary.test.ts

@@ -0,0 +1,178 @@
+import { BuildResult } from '../../src/build-results'
+import { renderSummaryTable } from '../../src/job-summary'
+import dedent from 'dedent'
+
+
+const successfulHelpBuild: BuildResult = {
+    rootProjectName: 'root',
+    rootProjectDir: '/',
+    requestedTasks: 'help',
+    gradleVersion: '8.0',
+    gradleHomeDir: '/opt/gradle',
+    buildFailed: false,
+    configCacheHit: false,
+    buildScanUri: 'https://scans.gradle.com/s/abc123',
+    buildScanFailed: false
+}
+
+const failedHelpBuild: BuildResult = {
+    ...successfulHelpBuild,
+    buildFailed: true
+}
+
+const longArgsBuild: BuildResult = {
+    ...successfulHelpBuild,
+    requestedTasks: 'check publishMyLongNamePluginPublicationToMavenCentral publishMyLongNamePluginPublicationToPluginPortal',
+}
+
+const scanPublishDisabledBuild: BuildResult = {
+    ...successfulHelpBuild,
+    buildScanUri: '',
+    buildScanFailed: false,
+}
+
+const scanPublishFailedBuild: BuildResult = {
+    ...successfulHelpBuild,
+    buildScanUri: '',
+    buildScanFailed: true,
+}
+
+describe('renderSummaryTable', () => {
+    describe('renders', () => {
+        it('successful build', () => {
+            const table = renderSummaryTable([successfulHelpBuild])
+            expect(table.trim()).toBe(dedent`
+                <table>
+                    <tr>
+                        <th>Gradle Root Project</th>
+                        <th>Requested Tasks</th>
+                        <th>Gradle Version</th>
+                        <th>Build Outcome</th>
+                        <th>Build&nbsp;Scan®</th>
+                    </tr>
+                    <tr>
+                        <td>root</td>
+                        <td>help</td>
+                        <td align='center'>8.0</td>
+                        <td align='center'>:white_check_mark:</td>
+                        <td><a href="https://scans.gradle.com/s/abc123" rel="nofollow" target="_blank"><img src="https://img.shields.io/badge/Build%20Scan%C2%AE-06A0CE?logo=Gradle" alt="Build Scan published" /></a></td>
+                    </tr>
+                </table>
+            `);
+        })
+        it('failed build', () => {
+            const table = renderSummaryTable([failedHelpBuild])
+            expect(table.trim()).toBe(dedent`
+                <table>
+                    <tr>
+                        <th>Gradle Root Project</th>
+                        <th>Requested Tasks</th>
+                        <th>Gradle Version</th>
+                        <th>Build Outcome</th>
+                        <th>Build&nbsp;Scan®</th>
+                    </tr>
+                    <tr>
+                        <td>root</td>
+                        <td>help</td>
+                        <td align='center'>8.0</td>
+                        <td align='center'>:x:</td>
+                        <td><a href="https://scans.gradle.com/s/abc123" rel="nofollow" target="_blank"><img src="https://img.shields.io/badge/Build%20Scan%C2%AE-06A0CE?logo=Gradle" alt="Build Scan published" /></a></td>
+                    </tr>
+                </table>
+            `);
+        })
+        describe('when build scan', () => {
+            it('publishing disabled', () => {
+                const table = renderSummaryTable([scanPublishDisabledBuild])
+                expect(table.trim()).toBe(dedent`
+                    <table>
+                        <tr>
+                            <th>Gradle Root Project</th>
+                            <th>Requested Tasks</th>
+                            <th>Gradle Version</th>
+                            <th>Build Outcome</th>
+                            <th>Build&nbsp;Scan®</th>
+                        </tr>
+                        <tr>
+                            <td>root</td>
+                            <td>help</td>
+                            <td align='center'>8.0</td>
+                            <td align='center'>:white_check_mark:</td>
+                            <td><a href="https://scans.gradle.com" rel="nofollow" target="_blank"><img src="https://img.shields.io/badge/Not%20published-lightgrey" alt="Build Scan not published" /></a></td>
+                        </tr>
+                    </table>
+                `);
+            })
+            it('publishing failed', () => {
+                const table = renderSummaryTable([scanPublishFailedBuild])
+                expect(table.trim()).toBe(dedent`
+                    <table>
+                        <tr>
+                            <th>Gradle Root Project</th>
+                            <th>Requested Tasks</th>
+                            <th>Gradle Version</th>
+                            <th>Build Outcome</th>
+                            <th>Build&nbsp;Scan®</th>
+                        </tr>
+                        <tr>
+                            <td>root</td>
+                            <td>help</td>
+                            <td align='center'>8.0</td>
+                            <td align='center'>:white_check_mark:</td>
+                            <td><a href="https://docs.gradle.com/develocity/gradle-plugin/#troubleshooting" rel="nofollow" target="_blank"><img src="https://img.shields.io/badge/Publish%20failed-orange" alt="Build Scan publish failed" /></a></td>
+                        </tr>
+                    </table>
+                `);
+            })
+        })
+        it('multiple builds', () => {
+            const table = renderSummaryTable([successfulHelpBuild, failedHelpBuild])
+            expect(table.trim()).toBe(dedent`
+                <table>
+                    <tr>
+                        <th>Gradle Root Project</th>
+                        <th>Requested Tasks</th>
+                        <th>Gradle Version</th>
+                        <th>Build Outcome</th>
+                        <th>Build&nbsp;Scan®</th>
+                    </tr>
+                    <tr>
+                        <td>root</td>
+                        <td>help</td>
+                        <td align='center'>8.0</td>
+                        <td align='center'>:white_check_mark:</td>
+                        <td><a href="https://scans.gradle.com/s/abc123" rel="nofollow" target="_blank"><img src="https://img.shields.io/badge/Build%20Scan%C2%AE-06A0CE?logo=Gradle" alt="Build Scan published" /></a></td>
+                    </tr>
+                    <tr>
+                        <td>root</td>
+                        <td>help</td>
+                        <td align='center'>8.0</td>
+                        <td align='center'>:x:</td>
+                        <td><a href="https://scans.gradle.com/s/abc123" rel="nofollow" target="_blank"><img src="https://img.shields.io/badge/Build%20Scan%C2%AE-06A0CE?logo=Gradle" alt="Build Scan published" /></a></td>
+                    </tr>
+                </table>
+            `);
+        })
+        it('truncating long requested tasks', () => {
+            const table = renderSummaryTable([longArgsBuild])
+            expect(table.trim()).toBe(dedent`
+                <table>
+                    <tr>
+                        <th>Gradle Root Project</th>
+                        <th>Requested Tasks</th>
+                        <th>Gradle Version</th>
+                        <th>Build Outcome</th>
+                        <th>Build&nbsp;Scan®</th>
+                    </tr>
+                    <tr>
+                        <td>root</td>
+                        <td><div title='check publishMyLongNamePluginPublicationToMavenCentral publishMyLongNamePluginPublicationToPluginPortal'>check publishMyLongNamePluginPublicationToMavenCentral publ…</div></td>
+                        <td align='center'>8.0</td>
+                        <td align='center'>:white_check_mark:</td>
+                        <td><a href="https://scans.gradle.com/s/abc123" rel="nofollow" target="_blank"><img src="https://img.shields.io/badge/Build%20Scan%C2%AE-06A0CE?logo=Gradle" alt="Build Scan published" /></a></td>
+                    </tr>
+                </table>
+            `);
+        })
+    })
+})

sources/test/jest/predefined-toolchains.test.ts

@@ -0,0 +1,117 @@
+import {getPredefinedToolchains, mergeToolchainContent} from "../../src/caching/gradle-user-home-utils";
+
+describe('predefined-toolchains', () => {
+    const OLD_ENV = process.env
+    afterAll(() => {
+        process.env = OLD_ENV
+    });
+
+    describe('returns', () => {
+        it('null if no JAVA_HOME_ envs are set', async () => {
+            jest.resetModules()
+            process.env = {
+                "JAVA_HOME": "/jdks/foo_8"
+            }
+
+            const predefinedToolchains = getPredefinedToolchains()
+            expect(predefinedToolchains).toBe(null)
+        })
+        it('valid toolchains.xml if JAVA_HOME_ envs are set', async () => {
+            jest.resetModules()
+            process.env = {
+                "JAVA_HOME": "/jdks/foo_8",
+                "JAVA_HOME_8_X64": "/jdks/foo_8",
+                "JAVA_HOME_11_X64": "/jdks/foo_11",
+                "JAVA_HOME_21_ARM64": "/jdks/foo_21",
+            }
+
+            const predefinedToolchains = getPredefinedToolchains()
+            expect(predefinedToolchains).toBe(
+                // language=XML
+`<?xml version="1.0" encoding="UTF-8"?>
+<toolchains>
+<!-- JDK Toolchains installed by default on GitHub-hosted runners -->
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>8</version>
+    </provides>
+    <configuration>
+      <jdkHome>\${env.JAVA_HOME_8_X64}</jdkHome>
+    </configuration>
+  </toolchain>
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>11</version>
+    </provides>
+    <configuration>
+      <jdkHome>\${env.JAVA_HOME_11_X64}</jdkHome>
+    </configuration>
+  </toolchain>
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>21</version>
+    </provides>
+    <configuration>
+      <jdkHome>\${env.JAVA_HOME_21_ARM64}</jdkHome>
+    </configuration>
+  </toolchain>
+</toolchains>
+`)
+        })
+    })
+
+    it("merges with existing toolchains", async () => {
+        jest.resetModules()
+        process.env = {
+            "JAVA_HOME_11_X64": "/jdks/foo_11",
+        }
+
+        // language=XML
+        const existingToolchains =
+            `<?xml version="1.0" encoding="UTF-8"?>
+<toolchains>
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>8</version>
+    </provides>
+    <configuration>
+      <jdkHome>\${env.JAVA_HOME_8_X64}</jdkHome>
+    </configuration>
+  </toolchain>
+</toolchains>
+`
+
+        const mergedContent = mergeToolchainContent(existingToolchains, getPredefinedToolchains()!)
+        expect(mergedContent).toBe(
+            // language=XML
+            `<?xml version="1.0" encoding="UTF-8"?>
+<toolchains>
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>8</version>
+    </provides>
+    <configuration>
+      <jdkHome>\${env.JAVA_HOME_8_X64}</jdkHome>
+    </configuration>
+  </toolchain>
+
+<!-- JDK Toolchains installed by default on GitHub-hosted runners -->
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>11</version>
+    </provides>
+    <configuration>
+      <jdkHome>\${env.JAVA_HOME_11_X64}</jdkHome>
+    </configuration>
+  </toolchain>
+</toolchains>
+
+`)
+    })
+})

sources/test/jest/resources/cache-cleanup/.gitattributes

@@ -0,0 +1,6 @@
+#
+# https://help.github.com/articles/dealing-with-line-endings/
+#
+# These are explicitly windows files and should use crlf
+*.bat           text eol=crlf
+

sources/test/jest/resources/cache-cleanup/.gitignore

@@ -0,0 +1,8 @@
+# Ignore Gradle project-specific cache directory
+.gradle
+
+# Ignore Gradle build output directory
+build
+
+HOME
+tmp

sources/test/jest/resources/cache-cleanup/build.gradle

@@ -0,0 +1,11 @@
+plugins {
+    id 'java-library'
+}
+
+repositories {
+    mavenCentral()
+}
+
+dependencies {
+    api "org.apache.commons:commons-math3:${System.properties['commons_math3_version']}"
+}

sources/test/jest/resources/cache-cleanup/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,6 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+# Deliberately not using the latest Gradle version for cache cleanup testing
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.0.2-bin.zip
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists

sources/test/jest/resources/cache-cleanup/gradlew

@@ -0,0 +1,245 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command;
+#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
+#     shell script including quotes and variable substitutions, so put them in
+#     double quotes to make sure that they get re-expanded; and
+#   * put everything else in single quotes, so that it's not re-expanded.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"

sources/test/jest/resources/cache-cleanup/gradlew.bat

@@ -0,0 +1,92 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo.
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

sources/test/jest/resources/cache-cleanup/settings.gradle

@@ -0,0 +1 @@
+rootProject.name = 'unused-dependencies'

sources/test/jest/resources/cache-cleanup/src/main/java/unused/dependencies/Library.java

@@ -0,0 +1,10 @@
+/*
+ * This Java source file was generated by the Gradle 'init' task.
+ */
+package unused.dependencies;
+
+public class Library {
+    public boolean someLibraryMethod() {
+        return true;
+    }
+}

sources/test/jest/short-lived-token.test.ts

@@ -0,0 +1,127 @@
+import {DevelocityAccessCredentials, getToken} from "../../src/develocity/short-lived-token";
+import nock from "nock";
+
+describe('short lived tokens', () => {
+    it('parse valid access key should return an object', async () => {
+        let develocityAccessCredentials = DevelocityAccessCredentials.parse('some-host.local=key1;host2=key2');
+
+        expect(develocityAccessCredentials).toStrictEqual(DevelocityAccessCredentials.of([
+            {hostname: 'some-host.local', key: 'key1'},
+            {hostname: 'host2', key: 'key2'}])
+        )
+    })
+
+    it('parse wrong access key should return null', async () => {
+        let develocityAccessCredentials = DevelocityAccessCredentials.parse('random;foo');
+
+        expect(develocityAccessCredentials).toBeNull()
+    })
+
+    it('parse empty access key should return null', async () => {
+        let develocityAccessCredentials = DevelocityAccessCredentials.parse('');
+
+        expect(develocityAccessCredentials).toBeNull()
+    })
+
+    it('access key as raw string', async () => {
+        let develocityAccessCredentials = DevelocityAccessCredentials.parse('host1=key1;host2=key2');
+
+        expect(develocityAccessCredentials?.raw()).toBe('host1=key1;host2=key2')
+    })
+
+    it('get short lived token fails when cannot connect', async () => {
+        nock('http://localhost:3333')
+            .post('/api/auth/token')
+            .times(3)
+            .replyWithError({
+                message: 'connect ECONNREFUSED 127.0.0.1:3333',
+                code: 'ECONNREFUSED'
+            })
+        await expect(getToken('localhost=key0', ''))
+            .resolves
+            .toBeNull()
+    })
+
+    it('get short lived token is null when request fails', async () => {
+        nock('http://dev:3333')
+            .post('/api/auth/token')
+            .times(3)
+            .reply(500, 'Internal error')
+        expect.assertions(1)
+        await expect(getToken('dev=xyz', ''))
+            .resolves
+            .toBeNull()
+    })
+
+    it('get short lived token returns null when access key is empty', async () => {
+        expect.assertions(1)
+        await expect(getToken('', ''))
+            .resolves
+            .toBeNull()
+    })
+
+    it('get short lived token succeeds when single key is set', async () => {
+        nock('https://dev')
+            .post('/api/auth/token')
+            .reply(200, 'token')
+        expect.assertions(1)
+        await expect(getToken('dev=key1', ''))
+            .resolves
+            .toEqual({"keys": [{"hostname": "dev", "key": "token"}]})
+    })
+
+    it('get short lived token succeeds when multiple keys are set', async () => {
+        nock('https://dev')
+            .post('/api/auth/token')
+            .reply(200, 'token1')
+        nock('https://prod')
+            .post('/api/auth/token')
+            .reply(200, 'token2')
+        expect.assertions(1)
+        await expect(getToken('dev=key1;prod=key2', ''))
+            .resolves
+            .toEqual({"keys": [{"hostname": "dev", "key": "token1"}, {"hostname": "prod", "key": "token2"}]})
+    })
+
+    it('get short lived token succeeds when multiple keys are set and one is failing', async () => {
+        nock('https://dev')
+            .post('/api/auth/token')
+            .reply(200, 'token1')
+        nock('https://bogus')
+            .post('/api/auth/token')
+            .times(3)
+            .reply(500, 'Internal Error')
+        nock('https://prod')
+            .post('/api/auth/token')
+            .reply(200, 'token2')
+        expect.assertions(1)
+        await expect(getToken('dev=key1;bogus=key0;prod=key2', ''))
+            .resolves
+            .toEqual({"keys": [{"hostname": "dev", "key": "token1"}, {"hostname": "prod", "key": "token2"}]})
+    })
+
+    it('get short lived token is null when multiple keys are set and all are failing', async () => {
+        nock('https://dev')
+            .post('/api/auth/token')
+            .times(3)
+            .reply(500, 'Internal Error')
+        nock('https://bogus')
+            .post('/api/auth/token')
+            .times(3)
+            .reply(500, 'Internal Error')
+        expect.assertions(1)
+        await expect(getToken('dev=key1;bogus=key0', ''))
+            .resolves
+            .toBeNull()
+    })
+
+    it('get short lived token with custom expiry', async () => {
+        nock('https://dev')
+            .post('/api/auth/token?expiresInHours=4')
+            .reply(200, 'token')
+        expect.assertions(1)
+        await expect(getToken('dev=key1', '4'))
+            .resolves
+            .toEqual({"keys": [{"hostname": "dev", "key": "token"}]})
+    })
+})

sources/test/jest/wrapper-validation/checksums.test.ts

@@ -0,0 +1,71 @@
+import * as checksums from '../../../src/wrapper-validation/checksums'
+import nock from 'nock'
+import {afterEach, describe, expect, test, jest} from '@jest/globals'
+
+jest.setTimeout(30000)
+
+test('has loaded hardcoded wrapper jars checksums', async () => {
+  // Sanity check that generated checksums file is not empty and was properly imported
+  expect(checksums.KNOWN_CHECKSUMS.checksums.size).toBeGreaterThan(10)
+  // Verify that checksums of arbitrary versions are contained
+  expect(
+    checksums.KNOWN_CHECKSUMS.checksums.get(
+      '660ab018b8e319e9ae779fdb1b7ac47d0321bde953bf0eb4545f14952cfdcaa3'
+    )
+  ).toEqual(new Set(['4.10.3']))
+  expect(
+    checksums.KNOWN_CHECKSUMS.checksums.get(
+      '28b330c20a9a73881dfe9702df78d4d78bf72368e8906c70080ab6932462fe9e'
+    )
+  ).toEqual(new Set(['6.0-rc-1', '6.0-rc-2', '6.0-rc-3', '6.0', '6.0.1']))
+})
+
+test('fetches wrapper jars checksums', async () => {
+  const validChecksums = await checksums.fetchUnknownChecksums(false, new checksums.WrapperChecksums)
+  expect(validChecksums.size).toBeGreaterThan(10)
+  // Verify that checksum of arbitrary version is contained
+  expect(
+    validChecksums.has(
+      // Checksum for version 6.0
+      '28b330c20a9a73881dfe9702df78d4d78bf72368e8906c70080ab6932462fe9e'
+    )
+  ).toBe(true)
+})
+
+test('fetches wrapper jar checksums for snapshots', async () => {
+  const nonSnapshotChecksums = await checksums.fetchUnknownChecksums(false, new checksums.WrapperChecksums)
+  const validChecksums = await checksums.fetchUnknownChecksums(true, new checksums.WrapperChecksums)
+
+  // Expect that at least one snapshot checksum is different from the non-snapshot checksums
+  expect(validChecksums.size).toBeGreaterThan(nonSnapshotChecksums.size)
+})
+
+test('fetches all wrapper checksum URLS for snapshots', async () => {
+  const checksumUrls: string[] = []
+  await checksums.addDistributionSnapshotChecksums(checksumUrls)
+
+  expect(checksumUrls.length).toBeGreaterThan(100) // May only be a few unique checksums
+  console.log(checksumUrls)
+})
+
+describe('retry', () => {
+  afterEach(() => {
+    nock.cleanAll()
+  })
+
+  describe('for /versions/all API', () => {
+    test('retry three times', async () => {
+      nock('https://services.gradle.org', {allowUnmocked: true})
+        .get('/versions/all')
+        .times(3)
+        .replyWithError({
+          message: 'connect ECONNREFUSED 104.18.191.9:443',
+          code: 'ECONNREFUSED'
+        })
+
+      const validChecksums = await checksums.fetchUnknownChecksums(false, new checksums.WrapperChecksums)
+      expect(validChecksums.size).toBeGreaterThan(10)
+      nock.isDone()
+    })
+  })
+})

sources/test/jest/wrapper-validation/find.test.ts

@@ -0,0 +1,12 @@
+import * as path from 'path'
+import * as find from '../../../src/wrapper-validation/find'
+import {expect, test} from '@jest/globals'
+
+test('finds test data wrapper jars', async () => {
+  const repoRoot = path.resolve('./test/jest/wrapper-validation')
+  const wrapperJars = await find.findWrapperJars(repoRoot)
+  expect(wrapperJars.length).toBe(3)
+  expect(wrapperJars).toContain('data/valid/gradle-wrapper.jar')
+  expect(wrapperJars).toContain('data/invalid/gradle-wrapper.jar')
+  expect(wrapperJars).toContain('data/invalid/gradlе-wrapper.jar') // homoglyph
+})

sources/test/jest/wrapper-validation/hash.test.ts

@@ -0,0 +1,12 @@
+import * as path from 'path'
+import * as hash from '../../../src/wrapper-validation/hash'
+import {expect, test} from '@jest/globals'
+
+test('can sha256 files', async () => {
+  const sha = await hash.sha256File(
+    path.resolve('test/jest/wrapper-validation/data/invalid/gradle-wrapper.jar')
+  )
+  expect(sha).toEqual(
+    'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
+  )
+})

sources/test/jest/wrapper-validation/validate.test.ts

@@ -0,0 +1,116 @@
+import * as path from 'path'
+import * as fs from 'fs'
+import * as validate from '../../../src/wrapper-validation/validate'
+import {expect, test, jest} from '@jest/globals'
+import { WrapperChecksums } from '../../../src/wrapper-validation/checksums'
+import { ChecksumCache } from '../../../src/wrapper-validation/cache'
+import exp from 'constants'
+
+jest.setTimeout(30000)
+
+const baseDir = path.resolve('./test/jest/wrapper-validation')
+const tmpDir = path.resolve('./test/jest/tmp')
+
+test('succeeds if all found wrapper jars are valid', async () => {
+  const result = await validate.findInvalidWrapperJars(baseDir, false, [
+    'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
+  ])
+
+  expect(result.isValid()).toBe(true)
+  // Only hardcoded and explicitly allowed checksums should have been used
+  expect(result.fetchedChecksums).toBe(false)
+
+  expect(result.toDisplayString()).toBe(
+    '✓ Found known Gradle Wrapper JAR files:\n' +
+      '  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 data/invalid/gradle-wrapper.jar\n' +
+      '  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 data/invalid/gradlе-wrapper.jar\n' + // homoglyph
+      '  3888c76faa032ea8394b8a54e04ce2227ab1f4be64f65d450f8509fe112d38ce data/valid/gradle-wrapper.jar'
+  )
+})
+
+test('succeeds if all found wrapper jars are previously valid', async () => {
+  const result = await validate.findInvalidWrapperJars(baseDir, false, [], [
+    'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
+    '3888c76faa032ea8394b8a54e04ce2227ab1f4be64f65d450f8509fe112d38ce'
+  ])
+
+  expect(result.isValid()).toBe(true)
+  // Only hardcoded and explicitly allowed checksums should have been used
+  expect(result.fetchedChecksums).toBe(false)
+
+  expect(result.toDisplayString()).toBe(
+    '✓ Found known Gradle Wrapper JAR files:\n' +
+      '  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 data/invalid/gradle-wrapper.jar\n' +
+      '  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 data/invalid/gradlе-wrapper.jar\n' + // homoglyph
+      '  3888c76faa032ea8394b8a54e04ce2227ab1f4be64f65d450f8509fe112d38ce data/valid/gradle-wrapper.jar'
+  )
+})
+
+test('succeeds if all found wrapper jars are valid (and checksums are fetched from Gradle API)', async () => {
+  const knownValidChecksums = new WrapperChecksums()
+  const result = await validate.findInvalidWrapperJars(
+    baseDir,
+    false,
+    ['e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'],
+    [],
+    knownValidChecksums
+  )
+  console.log(`fetchedChecksums = ${result.fetchedChecksums}`)
+
+  expect(result.isValid()).toBe(true)
+  // Should have fetched checksums because no known checksums were provided
+  expect(result.fetchedChecksums).toBe(true)
+
+  expect(result.toDisplayString()).toBe(
+    '✓ Found known Gradle Wrapper JAR files:\n' +
+      '  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 data/invalid/gradle-wrapper.jar\n' +
+      '  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 data/invalid/gradlе-wrapper.jar\n' + // homoglyph
+      '  3888c76faa032ea8394b8a54e04ce2227ab1f4be64f65d450f8509fe112d38ce data/valid/gradle-wrapper.jar'
+  )
+})
+
+test('fails if invalid wrapper jars are found', async () => {
+  const result = await validate.findInvalidWrapperJars(baseDir, false, [])
+
+  expect(result.isValid()).toBe(false)
+
+  expect(result.valid).toEqual([
+    new validate.WrapperJar(
+      'data/valid/gradle-wrapper.jar',
+      '3888c76faa032ea8394b8a54e04ce2227ab1f4be64f65d450f8509fe112d38ce'
+    )
+  ])
+
+  expect(result.invalid).toEqual([
+    new validate.WrapperJar(
+      'data/invalid/gradle-wrapper.jar',
+      'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
+    ),
+    new validate.WrapperJar(
+      'data/invalid/gradlе-wrapper.jar', // homoglyph
+      'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
+    )
+  ])
+
+  expect(result.toDisplayString()).toBe(
+    '✗ Found unknown Gradle Wrapper JAR files:\n' +
+      '  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 data/invalid/gradle-wrapper.jar\n' +
+      '  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 data/invalid/gradlе-wrapper.jar\n' + // homoglyph
+      '✓ Found known Gradle Wrapper JAR files:\n' +
+      '  3888c76faa032ea8394b8a54e04ce2227ab1f4be64f65d450f8509fe112d38ce data/valid/gradle-wrapper.jar'
+  )
+})
+
+test('can save and load checksums', async () => {
+  const cacheDir = path.join(tmpDir, 'wrapper-validation-cache')
+  fs.rmSync(cacheDir, {recursive: true, force: true})
+
+  const checksumCache = new ChecksumCache(cacheDir)
+
+  expect(checksumCache.load()).toEqual([])
+
+  checksumCache.save(['123', '456'])
+
+  expect(checksumCache.load()).toEqual(['123', '456'])
+  expect(fs.existsSync(cacheDir)).toBe(true)
+})

sources/tsconfig.json

@@ -0,0 +1,65 @@
+{
+  "compilerOptions": {
+    /* Basic Options */
+    "incremental": false,                     /* Enable incremental compilation */
+    "target": "es2021",                       /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
+    "module": "commonjs",                     /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */
+    // "allowJs": true,                       /* Allow javascript files to be compiled. */
+    // "checkJs": true,                       /* Report errors in .js files. */
+    // "jsx": "preserve",                     /* Specify JSX code generation: 'preserve', 'react-native', or 'react'. */
+    // "declaration": true,                   /* Generates corresponding '.d.ts' file. */
+    // "declarationMap": true,                /* Generates a sourcemap for each corresponding '.d.ts' file. */
+    // "sourceMap": true,                     /* Generates corresponding '.map' file. */
+    // "outFile": "./",                       /* Concatenate and emit output to single file. */
+    "outDir": "./lib",                        /* Redirect output structure to the directory. */
+    "rootDir": "./src",                       /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */
+    // "composite": true,                     /* Enable project compilation */
+    // "tsBuildInfoFile": "./",               /* Specify file to store incremental compilation information */
+    "removeComments": true,                   /* Do not emit comments to output. */
+    // "noEmit": true,                        /* Do not emit outputs. */
+    // "importHelpers": true,                 /* Import emit helpers from 'tslib'. */
+    // "downlevelIteration": true,            /* Provide full support for iterables in 'for-of', spread, and destructuring when targeting 'ES5' or 'ES3'. */
+    // "isolatedModules": true,               /* Transpile each file as a separate module (similar to 'ts.transpileModule'). */
+
+    /* Strict Type-Checking Options */
+    "strict": true,                           /* Enable all strict type-checking options. */
+    "noImplicitAny": true,                    /* Raise error on expressions and declarations with an implied 'any' type. */
+    "strictNullChecks": true,                 /* Enable strict null checks. */
+    "strictFunctionTypes": true,              /* Enable strict checking of function types. */
+    "strictBindCallApply": true,              /* Enable strict 'bind', 'call', and 'apply' methods on functions. */
+    "strictPropertyInitialization": true,     /* Enable strict checking of property initialization in classes. */
+    "noImplicitThis": true,                   /* Raise error on 'this' expressions with an implied 'any' type. */
+    "alwaysStrict": true,                     /* Parse in strict mode and emit "use strict" for each source file. */
+
+    /* Additional Checks */
+    // "noUnusedLocals": true,                /* Report errors on unused locals. */
+    // "noUnusedParameters": true,            /* Report errors on unused parameters. */
+    "noImplicitReturns": true,                /* Report error when not all code paths in function return a value. */
+    "noFallthroughCasesInSwitch": true,       /* Report errors for fallthrough cases in switch statement. */
+
+    /* Module Resolution Options */
+    // "moduleResolution": "node",            /* Specify module resolution strategy: 'node' (Node.js) or 'classic' (TypeScript pre-1.6). */
+    // "baseUrl": "./",                       /* Base directory to resolve non-absolute module names. */
+    // "paths": {},                           /* A series of entries which re-map imports to lookup locations relative to the 'baseUrl'. */
+    // "rootDirs": [],                        /* List of root folders whose combined content represents the structure of the project at runtime. */
+    // "typeRoots": [],                       /* List of folders to include type definitions from. */
+    // "types": [],                           /* Type declaration files to be included in compilation. */
+    // "allowSyntheticDefaultImports": true,  /* Allow default imports from modules with no default export. This does not affect code emit, just typechecking. */
+    "esModuleInterop": true,                  /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
+    // "preserveSymlinks": true,              /* Do not resolve the real path of symlinks. */
+    // "allowUmdGlobalAccess": true,          /* Allow accessing UMD globals from modules. */
+    "resolveJsonModule": true,                /* Enable importing JSON files as module; used for importing wrapper checksums JSON */
+
+    /* Source Map Options */
+    // "sourceRoot": "",                      /* Specify the location where debugger should locate TypeScript files instead of source locations. */
+    // "mapRoot": "",                         /* Specify the location where debugger should locate map files instead of generated locations. */
+    // "inlineSourceMap": true,               /* Emit a single file with source maps instead of having a separate file. */
+    // "inlineSources": true,                 /* Emit the source alongside the sourcemaps within a single file; requires '--inlineSourceMap' or '--sourceMap' to be set. */
+
+    /* Experimental Options */
+    // "experimentalDecorators": true,        /* Enables experimental support for ES7 decorators. */
+    // "emitDecoratorMetadata": true,         /* Enables experimental support for emitting type metadata for decorators. */
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["node_modules", "**/*.test.ts"]
+}